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SUMMARY 


In complex human-machine systems, operations, training, and standardization depend on a elaborate set 
of procedures which are specified and mandated by the operational management of the organization. 
These procedures indicate to the human operator (in this case the pilot) the manner in which operational 
management intends to have various tasks performed. The intent is to provide guidance to the pilots, to 
ensure a logical, efficient, safe, and predictable (standardized) means of carrying out the mission 
objectives. 

However, in some operations these procedures can become a hodge-podge, with little coherency in terms 
of consistency and operational logic. Inconsistent or illogical procedures may lead to deviations from 
procedures by flight crews, as well as difficulty in transition training for pilots moving from one aircraft 
to another. 

In this report the authors examine the issue of procedure use and design from a broad viewpoint. The 
authors recommend a process which we call “The Hour P’s:” philosophy, policies, procedures, and 
practices. We believe that if an organization commits to this process, it can create a set of procedures that 
are more internally consistent, less confusing, better respected by the flight crews, and that will lead to 
greater conformity. 

The “Four-P” model, and the guidelines for procedural development in Appendix 1, resulted from 
cockpit observations, extensive interviews with airline management and pilots, interviews and discussion 
at one major airframe manufacturer, and an examination of accident and incident reports involving 
deviation from standard operating procedures (SOPs). Although this report is based on airline 
operations, we believe that the principles may be applicable to other complex, high-risk systems, such as 
nuclear power production, manufacturing process control, space flight, law enforcement, military 
operations, and high-technology medical practice. 
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1. INTRODUCTION 


When we try to pick out anything by itself, 
we find it hitched to everything else... 


- John Muir 


1.1 BACKGROUND 

A complex human-machine system is more than merely one or more human operators and a collection of 
hardware components. In order to operate a complex system successfully, the human-machine system 
must be supported by an organizational infrastructure of operating concepts, rules, guidelines, and 
documents. The coherency of such operating concepts, in terms of consistency and logic, is vitally 
important for the efficiency and safety of any complex system. 

In high-risk endeavors such as aircraft operations, space flight, nuclear power production, chemical 
production, and military operations, it is essential that such support be flawless, as the price of 
deviations can be high. When operating rules are not adhered to, or the rules are inadequate for the task 
at hand, not only will the system's goals be thwarted, but there may also be tragic human and material 
consequences. Even a cursory examination of accident and incident reports from any domain of 
operations will confirm this. 

To ensure safe and predictable operations, support to the pilots often comes in the form of standard 
operating procedures. These provide the crew with step-by-s.ep guidance for carrying out their 
operations. SOPs do indeed promote uniformity, but they do so at the risk of reducing the role of human 
operators to a lower level. Furthermore, an exhaustive set of procedures does not ensure flawless 
system behavior: deviations from SOP have occurred at organizations that are regarded as highly 
procedurized. 

The system designers and operational management must occupy a middle ground: operations of high-risk 
systems cannot be left to the whim of the individual. Management likewise must recognize the danger of 
over-procedurization, which fails to exploit one of the most valuable assets in the system, the intelligent 
operator who is “on the scene.” The alert system designer and operations manager recognize that there 
cannot be a procedure for everything, and the time will come in which the operators of a complex system 
will face a situation for which there is no written procedure. It is at this point that we recognize the 
reason for keeping humans in the system. Procedures, whether executed by humans or machines, have 
their place, but so does human cognition. 

A dramatic example was provided by an accident at Sioux City. A United Airlines DC- 10 suffered a total 
loss of hydraulic systems, and hence aircraft control, due to h disintegration of the center engine fan disk 
(National Transportation Safety Board (NTSB|. 1990a). When the captair. had sized up the situation, he 
turned to the flight engineer and asked what the procedure was for controlling the aircraft. The reply is 
worth remembering: “There is none.” Human ingenuity and resource management were required: the 
crew used unorthodox methods to control the aircraft. This resulted in a crash landing in which well 
over half of the passengers survived 

This report is a continuation of our pre\ ious work on the human factors of aircraft checklists in air cam-r 
operations (Degani and Wiener, 199(1, 1993). Our research in this area was undertaken largely as a 
result of the discovery, during the investigation of the Northwest 255 crash (National Transportation 
Safety Board |NTSB|. 19X8) that checklists, for all their importance to safe operation, had somehow 
escaped the scrutiny of the human factors profession. The same, we later found, can be said of most 
flight-deck procedures. 
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1.2 PROCEDURAL DH VI ATION: ITS INFLUENCF ON SAFETY 

Problems within the human-procedure context usually manifest themselves in the form of procedural 
deviation. If all goes well, these deviations are not apparent to the operational management, and in most 
cases are left unresolved. They do become apparent, however, following an incident or an accident. In 
1987 Lautman and Gallimore conducted a study of jet-transport aircraft accident reports in order to 
“better understand accident cause factors.” They analyzed 93 hull-loss accidents that occurred between 
1977-1984. The leading crew-caused factor in their study was “pilot deviation from basic operational 
procedures” (Figure 1). 


Percent of occurrence 


1. Pilot deviation from basic 

operational procedures 33% 

2. Inadequate cross-check by 

second crew member 26% 

3. Crews not conditioned for proper 

response during abnormal condition 9% 

4. Pilot did not recognize need 

for go-around 6% 

5. Pilot incapacitation 4% 

6. Inadequate piloting skills 4% 

7. Errors during training flight 3% 

8. Other 15% 



Figure 1 . Significant crew-caused factors in 93 hull loss accidents. 

Source: Lautman and Gallimore (1987) 

Similar results were reported by Duke (199 l)in his analysis of 21 turbojet (Part 121) accidents. Lack of 
procedural behavior accounted for 69 percent of crew errors (more then three times larger than the 
second ranking category - decision making) 1 . These findings are clearly supported by three airline 
accidents that occurred in the last five years. In the first, Northwest Airlines Flight 255, an MD-82, 
crashed at Detroit Metropolitan Airport following a no-flap/no- slat takeoff (NTSB, 1988). In the second, 
Delta Air Lines Right 1 141, a B-727, crashed shortly after lifting off from Dallas-Fort Worth 
International Airport, following a no-flap/no-slat takeoff (NTSB, 1989). In the third, USAir Flight 
5050, a B-737, ran off the runway at La Guardia Airport and dropped into adjacent waters, following a 
mis-set rudder trim and several other problems (NTSB, 1990b). 

We submit that the classification of “pilot deviation from basic operational procedures” may be somewhat 
misleading. One should first ask whether the procedures were compatible with the operating 
environment. Were they part of a consistent and logical set of procedures? Most important, was there 
something in the design of the procedures or the manner in which they were taught that led a responsible 
pilot to deviate from them? 


Similar statistics, showing that procedural deviation is by far the highest ranking category in crew or operator caused 
accidents, can also be found in the maritime industry (Pcrrow, 1984. p. 207), and nuclear industry (V E. Barnes, personal 
communication, July 1993; Tragcr, 1988) 
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Hendrick (1987) states that human factors, or ergonomics, has two levels: micro-ergonomics and macro- 
ergonomics. Micro-ergonomics is focused at the direct human-machine system, e.g., controls, displays, 
etc. Macro-ergonomics, by comparison, is focused at the overall human-technology system and is 
concerned with its impacts on organizational, managerial, and personnel sub-systems. Likewise, we 
argue that in order to understand how pilots conduct flight-deck procedures, we cannot look only at the 
micro-ergonomics, i.e. procedures, but we also must also examine macro-ergonomics, i.e., the policies 
and concepts of operation, that are the basis on which procedures are developed, taught, and used. We 
submit that both the macro- and micro-ergonomics aspects of any complex human-machine system must 
be examined in order to improve any human-machine system. The same, we have found, is true for 
procedural design. 


1 .3 OBJECTIVES OF THE STUDY 

The intent of this work was to conduct a broad examination of design, usage, and compliance of cockpit 
procedures from both macro- and micro-ergonomics perspectives. The objectives were to: 

1 . Understand what procedures are. 

2. Identify the process by which procedures are presently designed. 

3. Understand whether procedures are actually used by line pilots, and why deviations from SOPs 
exist. 

4. Highlight some of the factors that affect procedural design. 

5. Provide guidelines for conceptual framework, design, and implementation of flight-deck 
procedures. 

Based on our previous work on checklists (De^ ni and Wiener, 1990; 1991), we developed a 
framework, or model, of the link between the goal of operation and conduct of procedures. In addition 
to the five objectives listed above, we also wanted to test the usefulness of this model for procedural 
design. The two chapters that follow will detail this theory. 


2. THEORY OF THE THREE P S: PHILOSOPH\ , POLICIES, AND PROCEDURES 


2.1 PROCEDURE DEVELOPMENT 

Procedures do not fall from the sky. Nor are they inherent in the equipment. Procedures must be based 
on a broad concept of the user's operation. These operating concepts blend into a set of work policies 
and procedures that specify how to operate the equipment efficiently. There is a link between procedures 
and the concepts of operations. We call that link “The Three P's of cockpit operations’’: philosophy, 
policies, and procedures. In this chapter we shall explore the nature of these links, and how an orderly, 
consistent path can be constructed from the company's most basic philosophy of operation to the actual 
conduct of any given task. The fourth P. “practices,” will be introduced in the next chapter. 

2.1.1 Procedures: What and Why? 

In general, procedures exist in order to specify, unambiguously, six things: 

1. What the task is. 

2. When the task is conducted (time and sequence). 

3. By whom it is conducted. 

4. How the task is done (actions). 

5. What the sequence of actions consists of. 

6. What type of feedback is provided (callout, indicator) 

The function of a well-designed procedure is to aid flight crews by dictating and specifying a 
progression of sub- tasks and actions to ensure that the primary task at hand will be carried out in a 
manner that is efficient, logical, and also error resistant. Another important function of a cockpit 
procedure is that it should promote coordination between agents in the system, be they cockpit crew, 
cabin crew, ground crew, or others. A procedure is also a form of quality control by management and 
regulating agencies (e g., FAA) over the airlines. 

2.1.2 Standard Operating Procedures 

Standard operating procedures are set of procedures that serve to provide a common ground for tv or 
three individuals (comprising a flight crew) who are usually unfamiliar with each other's experience and 
technical capabilities. So strong is the airline industry's belief in SOPs, it is believed that in a well 
standardized operation, a cockpit crew member could be plucked from the cockpit in mid-flight and 
replaced with another pilot qualified in the seat, and the operation would continue safely and smoothly. 

As mergers and acquisitions of airlines create “mega-carriers,” the process of standardization becomes 
increasingly important, costly, and difficult to achieve. Lhe need to render manuals, procedures, 
policies, and philosophies that are consistent and unambiguous becomes more difficult. This is because 
not all flight crews equally share the corporate history and culture that led to a certain concept of 
operation. Nevertheless, any human operator knows that adherence to SOPs is not the only way that one 
can operate equipment. There may be several other ways of doing the same task with a reasonable level 
of safety (Orlady, 1989). For example, most carriers require that crews enter the magnetic course of the 
runway into the heading select window on the mode control panel (MCP) before takeoff. One company 
requi *s that the first published or expected heading will be entered instead. Good reasons exist fot both 
procedures. 


2.2 PHILOSOPHY 

The cornerstone of our approach to th> -wcepts of cockpit procedures is philosophy of operations. By 
philosophy we mean that the airline re a ment determines an overarching view of how they will 
conduct the business of the airline, indui g fligh* operations. A company's philosophy is largely 
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influenced by the individual philosophies of the top decision makers. It is also influenced by the 
company’s culture, a term that has come into favor in recent years to explain broad-scale differences 
between corporations. The corporate culture permeates the company, and a philosophy of flight 
operations emerges, For a discussion on the development and implementation of a company-stated 
philosophy, see Howard ( 1990) 

Although most airline managers, when asked, cannot clearly state their philosophy, such philosophies of 
operation do indeed exist within airlines. They can be inferred from procedures, policies, training, 
aunitive actions, etc. For example, one company that we surveyed had a flight operation philosophy of 
granting great discretion (they called it “wide road”) to tne individual pilot. Pilots were schooled under 
the concept that they were both qualified and trained to perform all tasks. Consistent with this 
philosophy, the con pany allowed the first officer to call for as well as conduct (when he or she is the 
pilot flying) the rejec'ed takeoff (R IO) - a maneuver which is the captain's absolute prerogative at most 
carriers. 

The emergence of flight-deck automation as an operational problem has recently generated an interest in 
the philosophy of operations, partly due to lack of agreement about how and when automatic features are 
to be used, and who may make that decision (Wiener, 19X9). I his has led one carrier. Delta Air Lines, 
to develop a one- page formal statement of automatic'' philosophy i see Appendix 2 ). This philosophy is 
discussed in Wiener, Chidester, Kanki, Palmer, Curry, and Gregorich ( 1991 ). To the best of our 
knowledge, this is the first case where an airline management actually wrote out its philosophy and the 
consequences of the philosophy on doing business, and distributed copies to its pilots. 


2.3 POLICY 


The philosophy of operations, in combination with economic factors, public relations campaigns, new 
generations of aircraft, and major organizational changes, generates policies. Policies are broad 
specifications of the manner in which management expects things to be done (training, flying, 
maintenance, exercise of authority, personal conduct, etc.). Procedures, then, should be designed to be 
as much as possible consistent with the policies (which, in turn, should be consistent with the 
philosophy). Figure 2 depicts this frumew >rf 



Figure 2 The Three P's. 







The levels in the Three -P framework are not rigid. For some aspects of flight operations there may be 
several pohcies, f or others there may be only a philosophy. For example, checklist SOP is a mature 
aspect of flight operation: there can be an overall checklist philosophy, checklist policies for normal, 
abnormal, and emergency situations. Flight-deck automation is still in an immature stage of 

change^ 16111 AS ^ operation matures ’ P olicies will be defined and added, and philosophies may 

To illustrate the Three P's, let us assume that the task at hand is the configuration of an advanced 
technology aircraft for a Category-I ILS approach: 

1 . Philosophy: Automation is just another tool to help the pilot. 

2. Policy: Use or non-use of automatic features (within reason) is at the discretion of the crew. 

3. Procedure: On a Category-1 approach, the flight crew will first decide what level of automation 
to use (hand-fly with flight director; autopilot and mode control panel; coupled; etc.), which 
determines what must be done to configure the cockpit. 

4. Sub-tasks (or actions): Follow from procedures (e.g., tune and identify localizer and compass 
locator, set decision height, select autopilot mode, etc.) 

In some cases, policies that are actually remote from fl.ght operations can affect procedures. One 
carrier's new public relations policy called for more interaction between the cockpit crew and the 
passengers. It was recommended that at each destination the ^aptain stand at the cockpit door and make 
farewells to the passengers as they departed the cabin. In pai ocular, the marketing department wanted 
the pilot to be in place at the cockpit door in time to greet the disembarking first-class passengers This 
dictated a procedural change in that most of the SECl i*E-AIRCRAFT checklist had to be done alone by the 
tirstofficer. Thus checklist procedures which would normally be run by both pilots, probably as a 
challenge-and-response, were performed by a single pilot in deference to public relations imperatives. 

To conclude, it is our position that procedures should be based on the operational concepts of the 
organization. We hypothesize that if these operational concepts are specified (in writing) as a philosophy 
and a set of policies, then ( 1 ) a logical and consistent set of cockpit procedures that are in accord with the 
policies and philosophy can be generated, (2) discrepancies and conflicting procedures will be easily 
detected, and (3) flight crews will be aware of the logic behind every SOP 3 . We also hypothesize that ail 
of the above will lead to a higher degree of conformity to procedures during line operations. In addition, 
. * rainin g- transition training, and line and FAA checking will be made easier, and the general quality 
of flight operations w ill be enhanced. 

To design procedures, even in the mann-r that we have recommended, does not ensure perfect 
conformity by line crews. In the next chapter we will explore the actual practices as conducted on the 
line, and the reasons for non-conformity to standard operating procedures. This discussion extends the 
development of the model to the fourth "P" - practices. An all- inclusive model, linking the four P’s to 
line operations will be developed, and the role of feedback from line to management will be discussed. 


Roscnbrock (1990), makes a somewhat similar distinction between purpose, policy, and schedule, from a view point of 
a control theorist. 1 

3 ^! PraC ^± XamplC (ktailin ^ thc benefits of specifying policies prior to making technical decisions, see Hammond 
and Acklman (1976). 



3. THE FOURTH P: PRAC TICES 


3.1. AN EXTENSION OF THE THREE Ps 

As we began this study we focused on the macro-ergonomics aspects of flight operations: the 
philosophy, policies, and procedures. As we progressed, it appeared to us that something was missing. 
We discovers! that the macro-ergonomics approach had led us astray from the focal point of any human- 
machine system - the human operator. We neglected the ultimate consumer of the procedure -- the flight 
crew, whose decisions and actions determine the "system outcome.” 

To correct this, we have added an additional component -- practices. The term "practice” encompasses 
every activity conducted on the flight deck: correct execution of a procedure, deviation from a procedure, 
omission of a procedure, the use of a technique, or any other action. While a procedure may be 
mandatory, it is the pilot who will either conform to it or deviate from it. The procedure is specified by 
management - the practice is conducted by the crew. Ideally procedures and practices should he the 
same. The high prevalence of the "pilot deviation from SOP” classification mentioned earlier indicates 
that no one can assume that pilots will always follow any given procedure dictated by management 4 . 

The goal of flight management is to promote “good” practices by specifying coherent procedures. But 
we must also recognize that this is not always the case: procedures may be poorly designed. The crew 
can either conform to a procedure or deviate from it. The deviation may be trivial (e.g., superimposing 
some non-standard language on a procedural callout), or it may be significant (e.g., not setting the auto- 
brakes according to the takeoff procedures). The alternatives of conformity versus deviation can be 
visualized as a switch (Figure 3). This may be somewhat of an aver- simplification, but it expresses the 
choice that the crew member must make: to conform to the company's SOP, or to deviate. For example, 
we once observed a captain who, in response to the first officer's question regarding the conduct of a 
mandatory taxi procedure, replied "1 just don't do that procedure.” That captain, unequivocally, placed 
the switch in the deviate position. 



Figure 3. The deviate versus conform “switch'.' 


4 Assuming, of course, that the procedure is clear to the crew. Wc recogni/e, however, that this is not always the case and 
some SOPs can he ambiguous and lead to deviations by a well meaning pilot 
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We envision a term “A” — delta, or the degree of difference between procedures and practices (Figure 4). 
This “A, ’ not to be taken as a quantitative value by any means, expresses symbolically the amount of 
deviation from a specified procedure. This term has two components: ( 1 ) .he magnitude of deviation 
from the procedure, and (2) the frequency of such deviations during actual line operations. The goal of 
flight management is to minimize “A.” When “A” is large (flight crews constantly deviate from SOP 
and/or deviate in a gross manner), there is a problem. This “A” may be due to a crew's deviation and/or 
a problem in using this procedure. 



The human operator in this situation is analogous to a filter. From the above, standards and training 
departments dictate and teach the way procedures should be performed. However, in daily line 
operations (and not under the watchful eye ot a check-airman), the individual pilot may adjust the gauge 
of the filter. This gauge will determine the degree to which the SOPs actually will be observed, 
modified, misused, or completely ignored. The purpose of standardization is to bias the filter toward 
prevention of deviations. 

The consequences of the failure to conform to a procedure can be seen in the following report from 
NASA’s Aviation Safety Reporting System (ASRS)* : 

Our (light departed late PM local time for the 4:10 plus flight to SFO. FA) was PF. F!n- route discussed 
necessity to request lower altitudes with both OAK Center and Ray Approach when approaching SFO due to 
tendency to be “caught nigh" on arrival in this aircraft type. Area arrival progressed smoothly and we were 
cleared for the QL'IFT BRIDGE visual to 2XR. Gotxl speed control and vertical descent planning until vicinity 
of BRUJ LOM. When changing radio frequency f; >m approach to tower (head downi, F/O selected "open 
descent" to 400 feet MSL Autopilot was off, both flight directors were engaged, and autothrust was on. While 
contacting SFO tower I became aware that we were below the glideslopc, that airspeed was decaying, and that we 
were in an open dcsccir. Instructed die FA) to engage the "vertical speed" mcxle in order to stop our descent, 
restore the speed mode for the autothrust. and continue the approach visually once above the 2KR II.S 
glideslopc. Company procedures explicitly prohibit selecting an altitude below 1500 feet AGL for an open 
descent, siikc this places the aircraft close to the ground with engines at idle (ASKS Report No. |4%72 i 


’ ASRS reports arc quoted here verbatim. 
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To summarize, the ultimate factor that determines the quality of the system outcome is actual practices. 
Management s role does not end with the design of the pro^dure. Management must maintain an active 
involvement as the procedure moves trom management ou ces to the line, remain concerned with 
practices, and committed to management of quality through reduction of "A.” These goals are generally 
approached as “standardization,” a form of quality management aimed at ensuring compliance. 
Standardization is also a check on the quality of the procedures themselves, as well as on the training 
function. The Four-P model allows us to evaluate compliance versus non-compliance with 
procedures, standardization, and internal consistency of procedures with training. 


3.2 FEATURES OF THE ' FOUR-P" MODEL 

Our Four-P model is an extension of the “Tliree-P” model, taking into account the following: tasks, 
crews, practices, management, quality assurance, and the system outcome. Figure 5 is a more global 
depiction of the interrelationship of the elements as we see them. The top of the chan is essentially the 
same as in Figure 2. But when we get to the “crew” circle, we open the door to practices (and “A”). 

3.2.1 Deviations from Procedures 

In this section we shall examine several reasons why “A” exists, why a well-trained, well-standardized, 
and presumably well motivated pilot intentionally deviates from the company's published procedures. 


Individualism. “A” arises primarily due to the fact that pilots are individuals, and in spite of 
training, loyalty, and general devotion to safe practices, they will impose their individuality on a 
procedure. This may or may not adversely affect the system. We also recognize that there is a positive 
side to individualism: it is one of the differences between humans and computers. Individualism makes 
life interesting and provides us with an incentive to achieve. Pilots are not “procedure-doing” robots; 
they are individuals who bring to their job certain biases, preju dices, opinions, experiences, and self- 
concepts. For example, one of the most unusual practices we have observed was demonstrated by a 
captain of a B-757. Acting as pilot not flying (PNF), he tuned the arrival ATLS on the VHF radio, 
listened to it, and then rather than writing it on a pad or a form, he proceeded to encrypt it into the scratch 
line of the control display unit (CDU). He then read it from the CDU to the pilot flying. This was a 
captain who obviously wanted to make maximum use of his automated devices. Of course this method 
of recording the AT1S has its limitations, the most severe being that only one person in the world could 
decode the ATIS as recorded. 

The problem, of course, is the potential conflict between individualism and standardization in high-risk 
enterprises. On one hand, standardization is the foundation of a structured operation; on the other hand, 
humans are not machines (Rosenbrock, 1990). Furthermore, humans possess brains that allow great 
flexibility, ano this can become critically important in extreme cases where no procedure is available, 
e.g.. United's previously mentioned Sioux City accident (NTSB, 1990a). 

Complacency. It is well established in aviation that a pilot's vigilance may not remain at its highest, 
or even at an acceptable level at all times. This phenomenon of dropping one's guard is generally labeled 
complacency. Wiener ( 19K 1 ) has questioned whether the term has any real meaning, and whether its 
use makes any real contribution to understanding safety. Pending an answer to this question, it seems 
safe to say that complacency, as the term is used, may be responsible for many of the departures from 
S OP . 

It is the very safety and error tolerance of the system that may generate complacency and non-adherence 
to SOPs. If day after day, year after year, pilots encounter few threats, and few genuine emergency 
sttua.ions, the temptation to ease up and accept less than standard performance 1.1 understandable. Recent 
work by Parasurainan and his collaborators have examined what they call “automation complacency,” the 
tendency to become overly trustful and over-dependent on various automatic devices in the cockpit 
(Parasuraman, Molloy, and Singh, 1991). 






















Humor. Humor is closely related to individualism, but its consequence may be similar to that 
which results from complacency. Humor in the cockpit represents the desire to inject some variety and 
stimulation into an otherwise humorless situation. Humor, like individualism, has its place. It makes 
life enjoyable, overcomes the tedium of a highly precise job, and establishes a form of communication 
between crew members. It also carries potential hazards: 

I called for clearance to Saint Louis (STL) as follows: ‘clearance delivery, company identification, AT1S 
information, federal aid to Saint Louis.' Federal aid was meant to mean FAA clearance in a joking fashion. The 
controller misinterpreted this to mean that we were being hijacked and called the FBI and airport police.... 

Minutes later police arrived at the aircraft. 

It was not my intent to indicate we had a hijacking. I was merely requesting a clearance.... The phrase federal 
aid to obtain a clearance has been a sarcastic term used for years in the cockpit and 1 thought [it] could not be 
mistaken to indicate other problems. I will use absolutely standard phraseology in the future... (ASRS ReDort 
No. 248982) ^ 

During our cockpit observations, we noted checklist reading behavior when the pilot reads “gasoline” 
where the checklist requires a challenge of “fuel,” or use of the Spanish term uno mas instead of a 1000 
feet to level-off callout These departures are inevitable, as they break the monotony of a highly 
standardized and procedurized situation. The meanings are assumed to be clear and the departure from 
SOP is usually harmless. But that is exactly what cockpit standardization is all about: trying to eliminate 
the need to make unnecessary assumptions or interpretations during high-risk operations. The difficult 
decision is where to draw the line. Unfortunately, the absolute distinction between what is humor and 
what is a deviation from SOP usually depends on the outcome, if this non-standard verbiage (e.g., 
federal aid) caused a breakdown in communication that led to an incident, then it would be labeled ” 
deviation from SOP. It it did not result in an untoward consequence, then it would be humor. 

Nonetheless, we take the position that any deviations during critical phases of flight should not be taken 
lightly: We once observed a takeoff in which the captain was the pilot flying. The first officer was 
supposed to make standard airspeed calls of V- 1 , V-r, and V 2. Instead, he combined the first two into a 
non-standard cail of V-one-r , and at V-2 called, “two of 'em. Apparently, the captain knew what was 
meant by these strange calls, and while one cannot say that this was a dangerous compromise with 
safety, it did represent a potentially serious departure from SOPs. Perhaps worse, it established an 
atmosphere ot tolerance on the part of the captain of non-.-tandard (one may say sub-standard) 
performance, which laid the foundation for more serious SOP departures later in the flight. 

We may question what moved the first officer to depart from standard procedures and utter nonsensical 
callouts. This example could of course be attributed to complacency. The link may be that complacency 
induces the introduction of “hurr.or” in place of standardization. A critical phase of flight operations, 
such as takeoff, is probably not an appropriate arena for humor. 

Perhaps the appropriateness of humor on the flight deck is an area addressable by cockpit resource 
management (CRM). It might be a relatively simple matter for the captain, during his initial briefing, to 
advise the subordinate crew member(s) on how he or she feels about humor in the performance of 
duties. However, in spite of the fact that CRM training stresses free two-way communication in the 
cockpit, it might be somewhat more difficult for the other crew persons to do the same for the 
“humorous” captain. 

Frustration. Pilots may feel that they have been driven to non-conformity by frustrating forces 
beyond their control. An example would be the failure to use the oxygen mask (above FL 250) when 
one pilot leaves the cockpit in a modern, two-pilot aircraft. We repeatedly observed low conformity to 
this regulation. First, it is not comfortable to wear any mask; and second, in some modem aircraft, it is 
difficult to replace the inflatable masks in their receptacles. Pilots find it a frustrating task and avoid it by 
simply not conforming to the regulation. “A", in this case, is equipment-induced. 

We observed an interesting technique (or ploy) to overcome the mask while still obeying the regulation. 

In a two-pilot aircraft with the inflatable mask, the captain left the cockpit briefly while the aircraft was 
climbing unrestricted to FL 330. At about FL 200 the first officer called ATC and requested level off at 
FL 250, which he maintained until the captain returned, and then requested continuation of his climb (the 
mask is only required above FL 250). In this case the pilot conformed to the regulation and procedure. 
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but at some cost to the company (increased fuel usage resulting from sub-optimal climb profile) and 
possibly some inconvenience to the ATC system. 

3.2.2 Technique 

The term “technique” is defined here as a personal method (practice) for carrying out a task. The use of 
technique allows the pilot to express individualism and creativity without violating procedural 
constraints. If the technique is consistent with the procedure and the overlying policy, then the task is 
conducted with no violation of constraints, and “A” is zero. 

Techniques have been developed by pilots over their years of experience of flying various aircraft. 

Every pilot carries with him a virtual catalog of techniques. They are often fine points which pilots have 
discovered for themselves, experimented with, or learned from other pilots. Consider the following 
technique: 

The Quiet Bridge visual approach to runway 28R at San Francisco (SFO) requires a profile descent with fixes at 
6000 feet 18 DME, 4000 feet 13 DME, and recommended 1900 feet 6 DME from the SFO VOR. We once 
observed a crew that, in preparation for this approach, built these fixes into the FMC and named them “6000,” 

“4000,” and “1900” (in an A-320 FMC it is possible to give any name for a “man-made” wavpoint, as opposed 
to “SFO01,” etc. in other FMS aircraft). As they flew this approach using only the autopilot and manual 
flying, the depiction of these fixes and their associated names (altitudes) on the map display (HS1) provided an 
“enhanced” situation display. 

Why does the procedure writer not include the techniques as part of the procedure? Generally this is not 
advisable: the techniques are too fine-grained. If SOPs were replaced with the detailed descriptions 
necessary for one to carry them out, the flight operations manuals would be many times their present 
size. The company should be happy to specify the procedure and leave it to the individual pilot to apply 
what he or she considers the best technique. 

To the credit of the flying profession, pilots are always looking for better techniques. The motivations 
are various: professional pride, overcoming boredom, expression of individuality, the comfort of the 
passengers, and perhaps most salient, a feeling that they can find a better way. Note that some of the 
motivations are the same as those that led to deviant behavior and “A,” but in the case of techniques, they 
led to a more favorable result. Further discussion of technique, its relation and influence on policies, 
management, automation usage, and CRM, is provided in Chapter 5. 

3.2.3 Standardization 

Standardization is the palace guard of procedures. It is a management function which begins with the 
wnting of procedures, to ensure that they are consistent with the first two Fs (philosophy and policies), 
are technically correct, and are published in a manner that will be clear to the iine pilots. Standardization 
also extends to th? various quality assurance methods that allow flight management to monitor line 
performance, training performance (of both instructors and trainees), and to guarantee conformity to 
SOPs (low values of “A’ ). These methods include recurrent training, line oriented flight training 
(LOFT), line checks, and simulator check-rides. Standardization personnel play a vital part in 
establishing and maintaining the feedback loop which links the line to flight management. We shall now 
discuss the feedback process and its role in procedure development. 

3.2.4 Feedback 

Feedback from the line to management is an essential process because some procedures are not perfectly 
designed. Furthermore, changes in the operational environment constantly lead to procedural 
modifications. As we have noted earlier, another reason why pilots deviate from accepted procedures 
(create A ) is that they think that they know a better way. In some cases they may be right. 

One way of promoting conformity to procedures is by providing a formalized feedback between the 
operational world and flight management. Some may argue that this is not necessary and that flight 
management is pan of the operational world. On the other hand, the performance of line pilots is the 
ultimate measure of the adequacy of procedures because of their daily interaction with the operating 
environment. When written procedures arc incompatible with the operational environment, have 


technical deficiencies, induce workload, create conflicts in time management, or produce other problems, 
flight crews may react by resisting and deviating from SOP. 

We have used the word “formal” to describe the desired feedback path. Bland statements from 
management such as “my door is always open,” or “you can always go to your chief pilot” do not 
constitute a sufficient feedback path. Likewise, offhand comments given while passing in the corridors 
and in coffee shops do not qualify as effective feedback mechanisms. The line pilot must feel that his or 
her input is desired, and will be taken seriously. Ideally, feedback should be in written form. We 
recommend that all written communications from line to management result in a written reply. The 
frustration of a crew member who felt that management was unresponsive to feedback from the line can 
be seen in the following ASRS report. 

I am very concerned about the safety of the company's new checklist policy. The climb checklist has three 
different segments and it not completed until about of 18,000 feet The approach checklist has a descent check 
that precedes it. The landing check has four segments. The “landing check" is called after the approach flap 
settings. The "landing gear" call stands alone, and the final segments are completed after the final flaps are set 
The last segment requires both pilots to watch the flaps come down, no matter how busy an approach [we are 
flying]. We have had several major checklist changes over the last two years. This latest one is the most 
radical. Having flown with 20-30 F/Os using it, I find that about 30 to 40 percent of the time we are able to do 
all the checklists correctly. Since it takes so long to complete all the segments of the list, something usually 
gets left out Many times it's the "gear down" check, since it no longer is "gear down/landing check" as we have 
all done since day-one in our careers. Also much of the check is done with a flow that does not match the 
checklist. After time off you have to rc-mcmorizc the flow since it's so different from the list. I note that when 
a situation is light wc are all, at times, reverting back to some of the calls from the previous procedures. Even 
the new hires who never used another checklist arc not able to remember all the steps. The company imposed 
the procedures without input from the line, and is not interested in our input. Please help us convince the 
company that these procedures arc not user friendly before someone makes a serious mistake. (ASRS Report 
No. 155183) 

Discussing the feedback path from line to management forces us to consider briefly labor-management 
relations at airlines. To be successful, the feedback process must involve the participation of the 
appropriate pilots' representative group. The feedback path then would consist of a communication from 
the line to the pilots’ representative group, and thence to management. This may have some advantages 
over direct pilot-to-management communication, in that the pilot may wish, for various reasons, to be 
insulated from his or her managers. Also, by working through a committee, patterns can be observed by 
the committee members. 

For this system to be effective, it is essential that a cooperative, non-adversarial relationship exist 
between management and the representative group Tnis is sometimes difficult when contract 
negotiations are underway, or when for whatever reason tensions exist between pilots and management 
(e.g., a furlough has been announced). The feedback process can be effective only if management 
makes it clear that they are eager to receive input from the pilots' representative group on a non- 
adversarial basis, and the pilots' group in turn must resolve to stick to its safety mandate, and not be 
tempted to use safety as a smoke screen for contractual matters. It is a measure of the maturity of the 
management of both the company and the union if both sides can transcend “politics as usual” for the 
sake of promoting safety. 

Guideline #/ : A feedback loop from line pilots to flight management and procedure designers 
should be established. This feedback loop should be a formal process, as opposed to an 
informal process. It must be maintained as a non-punitive, reactive system, with mandatory 
feedback from management to the initiating line pilot about the progress of his report and/or 
suggestion. 

Having built a foundation for procedure development, and explored the reasons for non-conformity to 
procedures, we attempted to verify the model by a field study of actual airline management and line 
practices. This is described briefly in Chapter 4. 
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4. FIELD STUDY 


4.1 RATIONALE 

The previous sections detailed our framework, or model, of what we felt was the rational process. We 
Wwhed to test this framework in the real world of airline operations and to modify it depending on what 
we might discover. For this reason we sought and obtained the cooperation of three major U.S. airlines 
in hosting a field study. In a sense our approach was “anthropological”: we went into the field and 
observed both management and flight crews doing their jobs. 

There are two entities that design procedures: the operators of aircraft and the airframe manufacturers (or 
alternatively component manufacturers, such as avionics firms). Despite their common interest in 
establishing procedures which will promote flight safety, their approach and objectives are quite 
different. Our field study focused on the operators, and only briefly surveyed the second. The main 
body of this report is based on the operators’ approach to procedures and not that of the manufacturers. 


4.2 METHOD 

4.2. 1 Activities at Participating Airlines 

Three major U.S. airlines agreed to participate in this research study. These airlines had previously 
expressed an interest in evaluating the way they design procedures, and wished to cooperate with this 
project. We visited each of the three airlines, conducted interviews with flight management and line 
pilots, and attended procedural design meetings. We focused our research on procedures for automated 
cockpits (e.g., B-757/767, A-320, B-737-300). 

In addition, we wanted to see how procedures are actually conducted on the line (i.e. practices). We 
therefore conducted observations and informal discussions with line pilots while occupying the jumpseat 
with all three carriers. All companies and individuals were promised anonymity. No companies or 
individuals would be identified in connection with any particular statements, events, or findings. 

Interviews with flight management anil line pilots. Prior to conducting the interviews, we presented 
our initial concepts to personnel in flight management. Since the “Four-P” model encompassed both 
high level management and line pilots, we decided to interview both. The underlying rationale was that 
if we wanted to examine how the organization directs flight operations, we must first have a clear 
understanding of how flight operation concepts are perceived at each level within the organization. The 
questions for top management were aimed at philosophies and policies (see Appendix 3). As we 
descended the organizational ladder, the questions moved toward procedures and ultimately, toward 
practices. 

At each of the participating carriers, we started with the vice-president for flight operations, and worked 
our way down the ranks of flight management. The following personnel in each flight department were 
interviewed: 

1 . The head of the flight operation department (usually vice-president for flight operations) 

2 . The senior aid to the head of the flight department 

3 . Manager responsible for flight standards 

4. Manager responsible for flight training 

5 . Manager responsible for checking (check-airman program) 

6. Fleet manager of an advanced technology aircraft 

In cooperation with the pilot representative group, we conducted interviews with line pilots who were 
currently flying FMS equipped aircraft. We interviewed three or four pilots in each session. The sample 
at each airline ranged from nine to twelve pilots. We asked the flight crews the same questions that we 
asked flight management personnel (see Appendix 4). We wanted to test whether the concepts of 


operations and the philosophy of the airline are truly shared by management and line pilots, and how line 
pilots perceive their company's concept of operations. 

Procedure design meetings. We also wanted a view-port into the process itself. That is, how flight 
management actually designs or modifies procedures. We attended meetings in which procedural 
change, vere addressed. 

Jumpseat observations. Mindful of the last P of our “Four-P” model (practices), we wanted to 
observe how procedures are actually used in daily line operations. We also wished to informally discuss 
procedural concepts with line crews in their operational habitat: the cockpit. Appendix 5 contains the 
informal questionnaire used during line observations. This proved to be a very useful methodology. 
Flight crews discussed and pointed to procedural problems as they occurred. We flew a total of more 
then 200 legs and some 400 hours with the three cooperating airlines. 

4.2.2 Meeting at One Airframe Manufacturer 

The airframe manufacturer is the first to design procedures for a new aircraf. After the manufacturer 
completes the certification process (FAR Part 25), the customer operating under Federal Aviation 
Regulation Part 121, is responsible for certifying the procedures for the type of operation that the 
customer conducts. It is no secret that airline and manufacturer procedures do not resemble each other - 
their perspectives are very different. When we asked airline flight managers why they did not simply 
accept the procedures from the airframe manufacturer, their answer was always the same: “they design 
and build airplanes, we fly passengers.” 

This provides some friction between airline procedure designers and the manufacturers' representatives, 
who would prefer that their customers stay with the original procedures provided with the airplanes. An 
exception to the above, however, are some abnormal and emergency procedures. In this case most 
carriers adopt the manufacturer's procedures, with the exception of callouts and allocation of tasks 
among crew members. 

We surveyed one airframe manufacturer in order to understand its concepts for designing procedures. 

We presented our framework and conducted discussions with a group of managers and engineers 
responsible for procedure design. Our main objectives were ( 1 ) to understand how the manufacturer 
specifies procedures for a new aircraft, (2) to understand their view of the reasons why carriers take the 
manufacturer’s procedure and modify it. 

4.2. j Accident and Incident Databases 

In order to gain insight into the influence of procedures in the “real world” of line operations, we 
conducted searches of two databases: (1) the incident database of NASA's Aviation Safety Reporting 
System (ASRS), and (2) the accident database of the National Transportation Safety Board (NTSB). 

The chapters that follow are based on our work with the three U.S. airlines that participated in the study. 
We have tracked the flow of procedure development from the airframe manufacturer, its subsequent 
tailoring to fit the individual airline's operation, its use by the line pilot, and the never-ending process of 
modification. We will discuss the factors that affect procedure development, issues in procedure design, 
and provide guidelines for the designer. 
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5. FACTORS THAT BEAR ON PROCEDURE DESKJN 


In Chapters 1, 2, and 3 we formulated our generic approach to procedure development, modification, 
and management. This approach provides the user with a theoretical framework that is independent of 
any particular aircraft model, airline, or nation. In the following chapters we will show how the Four 
P's, as constructed in the first three chapters, can be applied to procedure development. 

In Chapter Five, we discuss those factors, both internal to and external to the cockpit, that affect 
operating procedures. In addition, we will confront the issue of pilot technique, and how it fits into, 
and is compatible w ith, the Four P's formulation. In Chapters 6 and 7 we detail some of the issues 
involved in designing and using procedures. Obviously we could not plunge into the details of every 
procedure. Nevertheless, we believe that the procedure designer will be able to identify themes and 
concepts in our formulation, and apply them 6 . 


5.1. PROCEDURAL DEVELOPMENT BY AIRFRAME MANUFACTURER 

In the past, airlines have criticized the airframe manufacturers for designing new procedures for new 
aircraft without sufficient consideration of the unique operational environment in which airlines “live.” 

In developing a new aircraft, one airframe manufacturer has taken steps to bridge this gap. The airframe 
manufacturer stated that it tries to target its procedure more toward Pan 121 operators, while 
acknowledging the differences in operational environment between airlines that may affect procedural 
design and flow. For example, different carriers provide manifest, gross weight, zero fuel weight, and 
trim info, nation at different times in the ground phase of the flight. This has considerable bearing on 
designing the procedures for this phase, as many tasks are dependent on this information. The 
manufacturer has to take these differences into account in designing the flow of tasks in the cockpit. 

As a conceptual framework for designing procedures for its new aircraft, the airframe manufacturer now 
attempts to design the new procedures based on its previous glass cockpits designs. In developing the 
procedures, the design team included instructors from the manufacturer’s customer training department. 
This was designed to achieve a significant level of procedural standardization between the previous 
aircraft and the new aircraft in order to facilitate positive transfer. Another goal was to standardize 
terminology. For example, the MCP button that engages the power setting for takeoff and climb has 
different names depending on the type of engines used (N 1 for CFM engines and EPR for Pratt and 
Whitney). In the new aircraft, the design team decided to call the button according to its function - 
Climb Power. Although the engineers who designed the system labeled the button “Thrust,” the 
instructors felt that line pilots would find the label “Climb Power” more appropriate for the task. In 
essence, the instructors on the design team performed a valuable transformation process between 
engineers who design the systems and the target population - line pilots, who must use these systems. 


5.2 WHAT PROMPTS A PROCEDURE CHANGE? 

Before considering the process of procedural changes by the airlines, we had to explore just what events, 
internal or external to the cockpit, might prompt a carrier to make changes in procedures. We were 
astonished at the great variety of events or conditions that could trigger procedure changes. These event 
include changes in procedures due to straight forward triggers such as new equipment, new maintenance 
data, new routes, and many more. In addition, these events included changes that at first seem remote 
from the cockpit, such as labor relations, marketing influence, new cabin regulations, etc. Seventeen of 
these categories, each with a brief example, are listed in Appendix 6. 


6 The authors must point out that the Four P's formulation, the concepts, and the guidelines presented in this report were 
not the result of an expenment. They were based on interviews, observations, examination of incidents and accidents, and 
our analysis of the problem The reader should understand that we have not "proven” the case for our approac h. 
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5.3 MERGERS AND ACQUISITIONS 

Mergers and acquisitions between airlines have been occurring at a dizzying pace since the enactment of 
the Airline Deregulation Act of 1978, and similar legislation in European countries. Today there are few 
“pure” airlines - all have mixed parentage, some of which is so complex that a given airline's tributaries 
can best be communicated by drawing a family tree. For example, the present Northwest Airlines 
acquired Republic in 1986. Republic in turn was the product of a three-way merger in the early 1980’s 
of North Central, Southern, and Hughes Airwest. Furthermore, Airwest itself was the product of the 
merger of a number of smaller airlines. One could probably not find (or create) three more diverse 
cultures. 

Mergers and acquisitions produced three effects that interest us here: 

1 . The corporate culture, which we shall discuss in Section 5.4, and other influences attributable to 
the history of the acquiring companies, are highly diluted. Although the acquiring company's 
culture has tended to prevail, due partly to geographic influences, the resulting companies no 
longer have a strong, unalloyed corporate culture. 

2. The acquiring company suddenly finds itself with mixed fleets of aircraft; various cockpit 
configurations of aircraft they already had; and aircraft that they did not previously operate. When 
Northwest acquired Republic in 1986, it became heir to the world’s largest fleet of DC-9s. In so 
doing, it also acquired a vast fund of experience in two-pilot operations. Prior to that, with the 
exception of a small number of B-757s acquire . just before the merger, Northwest had had no 
two-pilot aircraft in over two decades. 

3. With the mergers and acquisitions come mixtures of not only fleets of aircraft, but pilot groups, 
procedures, checklists, and other documentation. An immense standardization, training, and 
rewriting job results. The new standardized procedures are, of course, based on the philosophy 
of the acquiring company, which is sometimes very different than the philosophy of the acquired 
company (Degani and Wiener, 1990) 

The acquiring company typically hastens to make what revisions are necessary to operate the acquired 
fleet. In the case of aircraft that are new to the acquiring company, it is a vast, sprawling task to impose 
its philosophy, policies, procedures, methods, and documents on the new fleet and crews. Often the 
process antagonizes the pilots from the acquired fleet, who feel, perhaps with some justification, that 
their former company is the best authority on how to operate their aircraft. Nonetheless, standardization 
must take place; a company cannot efficiently operate under two sets of operations philosophies and 
procedures. A firm stand must be taken, or the operation will constantly “weave and curve” its operating 
philosophy in order to provide some floating compromise. This will result in constant changes in 
procedures that will not only confuse pilots from both acquired and existing airline, but will also alienate 
them. Wolff (1991, pp. 22-23) describes the takeover by Delta of the Pan American shutde: “Within a 
few days, we pilots received a 135-page addendum to our operating manual that described the aircraft 
differences... Some of these differences required changes and additions to Delta's normal procedures, 
so we also received about 100 pages of those to put into our manual after removing the original pages.” 

In summary, mergers and acquisitions impose upon the acquiring carrier the immense task of melding 
the two (or more) carriers into one. As we have noted, the acquiring carrier is confident that its way of 
operating is superior, and in the interest of standardization, imposes its procedures upon the acquired 
carriers). However, we might comment that it is probably the wise management at the acquiring 
company that looks carefully at the procedures and documentation of the acquired fleet to see if there is 
something to be learned. 

Finally, we take note of the fact that the next series of mergers and acquisitions are likely to involve 
international carriers. The first steps in this direction have already been made. If such mergers occur, 
this will superimpose upon the usual problems of melding two (or more) carriers and their cultures new 
problems (and opportunities) international in character. For a discussion of cultural differences between 
carriers, see Johnston (1993) and Yamamori and Mito (1993). 
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5.4 DIFFERENCES AMONG CARRIERS 


Atfirst glance, it is amazing to note the breadth of differences in operating procedures between carriers 
(Degam and Wiener, 1990). For example. Figure 6 present a B-757 checklist used by one airline and 
Presents a B-757 checklist used by another airline. It can instantly be seen that these two 
checklists are quite different. During our field study we were also surprised to find that some critical 
procedures such as a rejected takeoff or in-flight engine failure are also executed differently at the various 
earners. It may seem logical, from a pure “engineering” stand point, that for the same equipment the 
operating procedures must be the same. However, each airline has its own concepts of how its 
employees should normally operate the equipment. This difference in operating philosophy is usually 
reflected m normal and not in abnormal/emergency procedures. This is probably due to the fact that 
unlike normal procedures and routine tasks, emergency procedures tend to address only aircraft specific 
systems, and not the operational environment surrounding the aircraft (company, gate agents 
paperwork, passenger handling, airport-specific procedures, etc.). 
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Figure 6. A Boeing B-75 7 checklist used by one airline. 
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Thus, not only the hardware affects procedures -- the company culture and the structure of the 
operational environment also bear on procedural development. In the following sub-section we have 
listed some of these social factors. This is not an exhaustive list. 

5.4. 1 The Nature of the Carrier's Operations 

The operational character of the airline may dictate certain procedures. For example, a short-haul 
operator flying many legs per aircraft per day may wish to minimize ground time. At intermediate stops, 
the pilots may remain in the cockpit and keep certain equipment powered in order to facilitate a rapid 
tum-around at the station. A carrier operating identical equipment over fewer, longer legs would call for 
a complete shutdown at intermediate stations, and the pilots would probably depart the cockpit. Two 
different types of checklists would have to be designed to support the different type of operations. A 
checklist insensitive to the differences would result in a sub-optimal operation, and probably a high rate 
of procedural deviations. 

5.4.2 influence of a Strong Leader 

Some procedures stem from the biases and personalities of the managers and executives. Legend has it 
that Captain Eddie Rickenbacker insisted that Eastern Airlines use a QFE altimeter on approaches, in 
addition to the QNH altimeter, following an altitude-related accident 7 . QFE altimetry existed at Eastern 
Airlines until about three years before its demise 8 . Note that the decision to use QFE altimetry on 
approach and takeoff invokes a host of procedures peculiar to that airline. 

5.4.3 Influence of Corporate Culture 

The term “corporate culture” is a somewhat vague and elusive concept in the sociology of organizations. 
Culture refers to the underlying values, beliefs, and principals that serve as the foundation for an 
organizational management system as well as a set of management practices and behaviors that exemplify 
and reinforce those principals (Deal and Kennedy, 1983). As difficult as corporate culture is to define, it 
does exist and does exert an influence on philosophy and policies of operation. Certainly corporations 
do have a culture, stemming largely from the nature of their business, their geographic location, the 
background of their founders and present management. Strong cultural influence is portrayed when 
values and actions are consistent. This consistency serves to improve performance and efficiency. For 
example, one airline that we surveyed has a culture that places a high value on discipline, order, and 
devotio.i to duty. This, we believe, leads to an operating concept that is rigidly procedurized and highly 
standardized. The flight crews “religiously” adhere to their “SOPA” (SOP Amplified), which is the 
“bible” by which the airline is operated. It is a meticulously detailed description of procedures and tasks. 
An example of the extent of this company’s procedures can be seen in their system for altitude callouts 
prior to target altitude. Unlike most airlines which require a callout 1000 feet prior to the target altitude, 
the SOPA mandates two altitude callouts, the first at 2000 feet, then a second one at 1000 feet. 


5.5 ECONOMICALLY-DRIVEN INFLUENCES 

The cockpit is not oblivious to market and economic pressures (Monan and Cheaney, 1990). But the 
extent to which economic forces may have penetrated the flight deck and affected cockpit procedures may 
not be obvious. For convenience, we will divide these forces into two parts: market, or public relations 
procedures; and resource conservation procedures. 

5.5.1 Public Relations Procedures 

Most companies require the cockpit crew to make periodic public address (PA) announcements to the 
passengers in the interest of public relations. Although PA’s are always at the captain’s discretion, we 
are aware of at least one airline that specifies an altitude (on descent) at which the PA announcement is to 


7 QFE altimeter displays aircraft altitude in reference to airport elevation. QNH altimeter displays aircraft altitude in 
reference to mean sea level. 

8 To our knowledge, only one U.S. carrier (American Airlines) still uses the QFE altimeter in domestic operations. 
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be made. Consider, also, the following example: One company, providing mostly short-haul flights 
with fast turn-around, required all its pilots to avoid hard braking and fast turns in an attempt to make the 
nearest high-speed turnoff. Passengers' complaints to the company public relations office could not be 
ignored. Efficiency of operations yielded to passenger comfort. 

5.5.2 Resource Conservation Procedures 

Fuel conservation is a major consideration in development of airline procedures. Because the 
“multipliers” in airline operations over the fleets over time are so great, a procedural change yielding, on 
any given leg, a seemingly small saving can result in a very considerable dollar savings annually. This 
has brought about a host of fuel conservation procedures: single engine taxiing, delayed engine start, 
delayed lowering of landing gear and flaps, reduced use of the APU, and recalculation of fuel 
requirements. All have important procedural implications. 

Fuel is not the only consideration. Wear on equipment may lead to procedures such as derated takeoffs 
to reduce engine wear, lower flap extension speeds to reduce wear, and use of autobrakes for landing to 
reduce brake and tire wear. An example of the impact of equipment conservation on procedures is 
reduction of APU starts. One airline has the following procedure: on taxi-in, if the taxi time is estimated 
(by the crew) to be less than nine minutes on a B-757, they taxi on both engines and do not start the 
APU (two engines provide two generators) 9 . 


5.6 AUTOMATION 

Our observations suggest that increased automation reduces the number of procedures on the fight deck. 
It appears that as systems become more autonomous (engaged in higher levels of automation) there is 
less need for procedures. It is not that the procedure evaporates as soon as the system is automa’ed - the 
point is that the procedure is simply written in software, and therefore the machine takes over some 
aspects of the procedure execution. For example, consider the task of rolling out of a turn. When hand 
flying an aircraft, a useful rule of thumb (or procedure), is to start leveling the wings several degrees 
prior to the assigned heading. The time-honored rule of thumb is to lead the rollout heading by the 
number of degrees equal to half of the angle of bank (e.g., for a bank angle of 10 degrees to turn right to 
a heading of 090, rollout will be initiated at 085). On the other hand, when the autopilot is engaged, the 
flight crew will dial 090 in the heading \ ndow and the plane will turn and level off by itself. Again, it 
is not that the procedure has vanished, be it is simply concealed in the autopilot computer code (in a 
more precise control algorithm, of cours 1 ,. In a previous paper (Degani and Wiener, 1991), we 
described procedures as a bridge between the crew and the machine. With increased automation, duties 
and procedures that were previously assigned to the human are now usurped by the machine. 

Conversely, when there is a need for a reduction in level of automation, a procedure must be instituted. 
For example, consider the following situation. When a glass cockpit aircraft is intercepting the glide 
slope and localizer while HEADING SELECT mode is engaged, and subsequently selecting APPROACH 
mode before the “localizer” and “glide slope” are captured, there is a possibility for a false capture: The 
“glide slope” will capture and the plane will start to descend while maintaining the heading displayed in 
the HEADING SELECT window (and not the LOCALIZER course). The concern is obvious - the aircraft 
will descend, but not to the runway. The only feedback available to the flight crews is on the ADI: the 
LOCALIZER symbol will be armed (white), uS opposed to being engaged (green) 10 . To counter this, one 
company's SOP states: “to prevent a false capture, do not arm the approach mode until the localizer 
and glide slope pointers have appeared on the ADI.” 


9 This is due, in part, to the fact that the APU uses more fuel to start than running an engine Another benefit of this 
procedure is the reduction in the number of APU start sequences. 

10 This information can not be obtained from the mode control panel (MCP) -- because according to the MCP logic, once 
APPROACH mode is armed, the button is lit (regardless of whether the “localizer" hr .iccn captured or not). 
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The above example shows how automation and procedures are inversely related. To “fix” a problem 
with automation, one must go one step down in the level of automation. Subsequently, this requires ?n 
increase in procedurization - the pilots of this company may only engage the APPROACH mode after 
seeing the localizer and “glide slope” pointers on the ADI. 


It appears that increased level of automation eliminates the need for some procedures. Also, automation 
makes it more difficult to mandate a larg' set of stringent procedures. We believe several factors lead to 
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Some tasks that were previously assigned to the pilot have been completely automated For 
example, the engine stare sequence of an Airbus A-320 has been automated This has resulted in 
one ess engine control (the “fuel control” switch), reduction in task requirement (positioning the 
fuel control switch to run ’), and enu,. action of associated procedures (“Aborted Engine Starts 
or Excessive EGT on Ground”), as the system provides all limit protection as well as automatic 
engine crank after stare abort. 


2. Since most modem automation is controlled by some type of digital processor, the interface 
between human and machine is usually some form of computer input device. The most common 
form is a keyboard. Using the CDU, simple tasks, such as position initialization, can be 
performed as a set of procedures. Nevertheless, tasks that must be conducted in real time, require 
tar more complex interaction with the computer, and hence are not amenable to simple 
?^cw^ Zation ‘ F ° r instance ’ man y CTews build approaches that are not available in the FMC. 

. . • routm g and STARs will guide them to a certain point short of the airport. If they wish 
rMC guidance the rest of the way, they have to build it, and this is too complex to be reduced to 
step-by-step procedures and sub-tasks. 

3. Many aircraft systems, such as the autoflight system, operate in a dynamic and sometimes 
unpredictable environment and therefore cannot be completely pre-programmed. In these cases, 
the autoflight system provides the pilot with several semi-automatic modes to choose from. An’ 
example is the various modes available to perform a level change: there are at least five different 
methods to conduct this task. Therefore, any attempts to completely procedurize such tasks by 
mandating one method, would usually fail (and lead to non-compliance). One major U S 
company attempted to procedurize the descent profile of its B-737-EFIS fleet. The result was 
non-compliance. The project was quietly abandoned. 


To conclude, we argue that automation requires a new dimension in the design of flight deck procedures. 
As we have noted previously, a procedure that is ponderous and is perceived 's increasing workload 
and/or interrupting smooth cockpit flow will probably be ignored on the line, iven worse, there could 
be a spreading of this effect, since a rejected procedure may lead to a more gene ral distrust of 
procedures, resulting in non-conformity in other areas. 


Guideline #2: When designing procedures for automated cockpits, the designer should 
recognize that many tasks that involve the use of automation are too complex and interactive to 
allow a stringent set of SOPs to be mandated. 


5.6.1 Lack of A utomation Philosophy 

Most airlines that fly glass cockpit aircraft have attempted to develop an operational doctrine for operating 
these aircraft. Those that have failed to articulate a clear philosophy (and hence policies) have probably 
done so because they jumped immediately into policies, and in some cases straight into procedures 
without a governing philosophy. 6 y 

One of the problems with not developing and publishing a philosophy of operations is that policies 
decisions, and ultimately procedures are put into place without an explanatory basis. The philosophy 
behind these decisions is not articulated nor understood. What is more, philosophies change from time 
to time. Because these changes in philosophy are not made public, they can lead to confusion and to a 
compliance problem. For example, one airline's early automation doctrine was to fly an automated 
aircraft, totfie e *^nt P° ss ^ e ’ as if it were a B-727, and thereby minimizing the use of advanced 
features. Then, following a change in management, it switched to a philosophy of “use the automation 
as much as possible (in order to save fuel, wear, etc.). Recently, as indicated by the vice president of 
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flight operations, the philosophy moved to a more “liberal” approach to automation, stating that “there 
are many 'detents' between 'fully automated' and 'manual.'” Although this new doctrine has been 
conveyed to some crews, it was not done in a formal way. Some check airman are still rating check 
rides according to the management philosophy that pilots describe as “we bought it, you use it.” 

Not surprisingly, many flight crews complained during our interviews that they are using semi-automatic 
modes during descent on a regular basis, but when a check airman arrives they try to use L/VNAV as 
much as possible. One captain explained, “why argue and get into long discussions. If that's what he is 
looking for, I’ll give it to him.” Note that the Delta automation philosophy statement (Appendix 2) 
leaves no doubt about where the company stands regarding use of levels of automation. The crews are 
expected to be proficient in employing the automation at every level, but the choice of automation versus 
manual modes remains in the cockpit. 

Guideline #3: It is essential that management develop a philosophy of its operations. This is 
particularly important for operating automated cockpits. 

5.6.2 Automation and Procedures 

Introducing any new technology into the cockpit, or any other domain, requires the procedure designer 
to (1) reevaluate all of the existing concepts and policies in light of the new technology, and (2) support 
the new technology via new procedures. For example, traditional cockpit procedures specify that the 
pilot-not-flying (PNF) sets the altitude in the altitude window/alerter. Recently, however, several glass 
cockpit fleets have changed their policies and procedures so that the pilot-flying (PF) is responsible for 
all flight path control actions while an autopilot is engaged. The new procedure indicates that the PF 
(and not the PNF) is responsible for setting the altitude when the autopilot is used. The reason for this is 
explained by the logic of the autoflight system: when the autopilot is engaged, the aircraft flight path can 
be controlled via the MCP altitude window (the autopilot will not cross the altitude set in the MCP 
window). The policy and procedure developers argue tha f night path control should not be split between 
the PF and PNF. 

Guideline tt4\ When introducing new technology into the cockpit, the procedure designer 
should reevaluate all of the existing procedures and policies in light of the new technology and 
support the new technology via new procedures. I 1 


5.7 USING TECHNIQUE 

The role of pilot technique must be recognized for two reasons. First, the procedure developer cannot 
and should not try to write “a procedure for everything.” It would be both futile and uneconomical to 
develop a forest of minute details and huge procedures books (and the pilot would not conform to all 
these anyhow). Second, each individual pilot harbors a large program of techniques for carrying out 
procedures. They represent his or her “personal style” of flying, a highly individualized way of getting 
the job done. 

5.7. 1 Technique and Automation 

The introduction of cockpit automation has brought a plethora of techniques, largely consisting of ways 
in which the pilots choose to employ the automatic devices and modes to achieve a desired result. These 
techniques are the result of the great variety of ways that a task can be accomplished in a high-technology 
aircraft, due to its many modes and options. For example, there are at least three different methods in 
which plane position information can be transferred into the Inertial Reference System of a glass cockpit 
aircraft. 

Another example is the automatic level-off maneuver. Many pilots feel that left to its own, the auto- 
leveling produces flight maneuvers that are safe and satisfactory, but could be smoother and more 
comfortable for the passengers. Pilots also believe that in the auto-level-off maneuver the autothrottles 
are too aggressive. As a result of this, many have developed techniques to smooth these actions; most of 
these techniques involve switching autopilot modes during the level-off. We emphasize that these are 
techniques and not procedures. As stated earlier, they represent the superimposition of the pilot's own 
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way of doing things upon a standard procedure. Some pilot technique is actually accommodated by 
modem flight guidance systems. The bank angle limiter, for example, invites the crew to express their 
preference for maximum bank angles and rates of turn, consistent with the demands of ATC, the comfort 
of their passengers, and the crew's preferences. 


Other techniques have been developed to “trick the computer.” For example, the pilot of a glass cockpit 
aircraft, wishing to start a descent on VNAV path earlier than the displayed top of descent (TOD) point, 
can either enter a fictitious tail-wind into the flight guidance computer, or can enter an altitude for turning 
on thermal anti-ice protection (which he has no intention of actually doing). Both methods will result in 
a re-computation of the TOD and VNAV path, with an earlier descent. Why would the pilots do this? 
Because experience has taught them that the correctly computed VNAV path often results in speeds that 
require the use of spoilers, which pilots consider unprofessional, as well as creating vibration that will 
discomfit the passengers (Wiener, 1989). 


5.7.2 Techniques and Procedures 


Techniques are usually superimposed on procedures. The procedure specifies tasks, while the technique 
is the pilot’s way of adding his or her own methods on top of the tasks. Techniques are usually found in 
tasks that are more loosely procedurized (e.g., level-off task). Techniques are rarely found in tasks that 
are tightly procedurized (in which every action is detailed in the procedure, e.g., engine shut down). For 
example, one altitude setup procedure for hand flying states that the “PNF sets the MCP/altitude alerter 
altitude and points to the MCP/altitude alerter. The PF points at the new altitude and verbally 
acknowledges it.” One captain stated that in addition to the above procedure, he (as PNF), first sets the 
altitude in die MCP/altitude alerter, and only then reads back to ATC whatever he has entered into the 
MCP/altitude alerter. While the task takes somewhat longer when performed this way, it attempts to 
eliminate the possible transformation error between what is held in the pilot’s short term memory and 
what is actually entered to the machine. This technique does not violate the procedure, but rather 
imposes an additional action to reduce the likelihood of a readback error. 


The framework of how the above readback technique fits in with the higher level task and procedure 
can be seen in Figure 8. 
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Figure 8. Framework of a technique and procedure. 
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5.7.3 Technique and Policies 

tecbn ' que ma ^ * ndeed conform to the written procedure, and thus not add to “A ” but could 

eveU^ Consider ^ example mentioned ether (sJl ?2A) of 

nvvoJIfmlc? 1 m ,K^° d U g hmb lo a hlgher cru,se a,titude for the sake of avoiding the use of the ’ 
oxygen mask. If this technique is evaluated from a procedural stand point there is no “A ” The 

techmque is in full conformity with the FAR and company proceZef Yet i if ccLlv 

^rcfore hTs^ot eniuth" for the TT ab ° Ut effici f nCy ° f °P eratlons * then il is non-co&otiiity. 
the ^hcTes ^ f * techmque t0 confonn t0 lhe Procedure; it must also be consistent with 

In some cases there is no procedure for a given task and related procedures do not help in solving the 
problem. At this point policies are the only guidance to the crew on how they may use a techniaue It is 

tlTt^ and phi,OS °P hy pays off Figa * 9 depicts this y relationship bet ween^ 
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Figure 9. Framework of technique atul policy. 
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to maintain this speed up to 10,000 by adjusting pitch and ignoring the flight director pitch bar. This technique 
had proven to give a much smoother level off and acceleration to climb speed. 

Our takeoff had been behind an aircraft and slightly after takeoff we had experienced a little turbulence which we 
assumed was from the proceeding wide body. The captain decreased pitch to stay out of his wake while we both 
were looking outside of the aircraft in an effort to see the wide-body. Unable to acquire the aircraft, the captain's 
scan returned to his ADI and he began to follow the pitch bar, which led him to accelerate beyond 250 knots 
Aircraft speed was noted and reduction begun. Aircraft accelerated to approximately 320 knots (ASRS Report 
No. 155390). 

For the sake of explaining how policies affect technique, let us assume that the airline had a policy of 
backing up critical tasks with other modes or aids. Examples of procedures that stem from such policy 
would be a requirement that visual approaches should be backed-up by the ILS and/or ADF, and a 
procedure specifying that pilots of automated cockpits track LNAV heading by appropriately updating the 
MCP heading display whenever the aircraft changes heading. If such a policy is specified, then one can 
argue that both of the auto-leveloff techniques that we have detailed above violate this policy. Such a 
policy provides that a failure of a certain system component does not leave the crew empty handed. The 
intent is that the crew choose their primary mode, but also configure other modes to which they or the 
system can default to. The same policy can be applied for automation, i.e., configure all the appropriate 
automation modes so that if one fails, the pilot or the system can easily default to another. As can be 
seen in the ASRS report above, the 300-knots technique does not comply with this policy. 

Similar policies of backup as related to use of automation can be seen in the following altitude procedure: 
“Do not set expected altitudes in the MCP/altitude alerter. Set the most restrictive altitudes as opposed to 
the top/bottom altitudes.’’ The concept here is if the automation (VNAV) fails, then the autopilot will not 
cross the hard altitude set in the MCP window. At other airlines this is done differently: during the step- 
down descent the altitude window is set for the lowest restriction. The reader should note that both 
procedures stem from a different operating policy of the autoflight system. 

Let us examine another technique from a policy standpoint: 

After takeoff the aircraft accelerated to 250 knots and flaps were retracted. While in a tight (30 degree bank) turn, 

ATC requested: "slow to 230 knots." The captain (PF) disengaged the autothrottlcs, reduced power and pitch, 
and maintained 230. After being cleared back to 250 knots he re-engaged them. At cruise, we asked him why 
disengaged the autothrottlcs. He replied that the clean (no flaps) maneuvering speed was 245, therefore, had he 
dialed 230 knots in the speed window, the alpha protection logic of the autothrottlcs would have maintained a 
speed of 245. Since he did not want to "dirty” the aircraft by extending slats, he choose to disengage the 
autothroules (and with it, the alpha floor protection), reduce bank angle, and maintain 230. He stated that this 
was not per SOP. Nevertheless, he felt that other built-in protection of the aircraft would have prevented him 
from reaching buffet speed. 

To answer the question of whether or not this example represents an acceptable technique, one must 
compare it with the company’s stated policies. If this technique is compared to the policy, discussed 
above, of backups and defaults for using automation, then, of course, it is not acceptable. 

To summarize, our position is that a technique not only must conform to the procedure -- it must also 
conform with the company policy. The fact that a technique does not violate a written procedure 
(produces no “A”) does not necessarily make it acceptable The technique may still entail an unessential 
risk and inefficiency. Every technique must therefore conform to both procedures and policies (and 
possibly philosophies). 

5.7.4 Technique and Management 

What view should management take of pilots developing their own techniques? Does the 
superimposition of “personal" technique on SOPs represent a compromise with standardization? Once 
again the answer is to be found in the “Four-P” model. Management must develop a philosophy that 
governs the freedom of the pilot to improvise, and from this philosophy will flow company policies that 
will state exactly what the company expects of the line. Our own view, of course, is to return to the 
definition of “A.” If the techniques employed on the line lead to practices that are consistent with the 
published procedure and policies, then “A" is zero and management should not interfere. 
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For example, one company constantly changed its procedure for setting of the bank angle limiter of a B* 
757. It was perceived by the line pilots that every time there was a staff change in flight management, a 
new procedure would appear. Finally, this procedure was eliminated and the setting was left to pilot 
discretion (or in our terms, assigned to “technique”). Likewise, if the same procedure constantly 
changes because of changing environmental conditions or because there is never an agreement in flight 
management on how to implement it -- it may be downgraded to the level of a technique (considering, of 
course, all the other issues such as criticality, CRM, etc.). 

If, however, management discovers through standardization and quality management techniques, or 
through the feedback loop, that certain techniques may have potential for procedural deviation, then this 
can be dealt with through the normal quality assurance processes. It is entirely possible that the opposite 
can occur, that the quality management or feedback processes can discover superior techniques that 
should become procedures. Check airmen play a vital role here. While their job is generally quality 
assurance and standardization, they should be watchful for line-generated techniques that could and 
should be incorporated into the company's SOPs. 

Guideline #5: Management, through the feedback loop and the line check airman program, 
should be watchful of techniques that are used on the line. Techniques that conform to 
procedures and policies should not be interfered with. Techniques that have a potential for 
policy and procedure deviation should be addressed through the normal quality assurance 
processes. Techniques that yield better and safer ways of doing a task may be considered for 
SOP. 

5.7.5 Technique and CRM 

Our discussion of technique has centered on the means of executing company-generated cockpit 
procedures. The same principles apply to the vast and ill-defined area known as cockpit resource 
management (Wiener, Kanki, and Helmreich, 1993). Pilots develop communication, team-building, 
stress management, and other mechanisms for getting the job done effectively. These can also be viewed 
as techniques, personalized ways of carrying out procedures. 

CRM training programs attempt to teach principles of communication; specific CRM techniques are 
discovered later. As with cockpit techniques, CRM techniques are developed largely by trial and error, 
as well as observations of others. We have ail seen examples of good and bad communications 
techniques in the cockpit and elsewhere. We can again apply the definition of “A.” If one's personal 
CRM techniques lead to congruence between procedures and practices, they should be considered 
adaptive. If not, they generate “A” and must be dealt with through the same quality management 
mechanisms that are invoked by unsatisfactory piloting. Our comments of the last section apply to CRM 
as well: check airmen should be vigilant in observing adaptive and maladaptive CRM techniques on the 
line and in training. 

The hazards of poor crew coordination with regards to using a technique, can be seen in the following 
ASRS report. 

We were cleared to cross 40 NM west of LINDEN VOR to maintain FL 270. The captain and I began 
discussing the best method to program the CDU to allow the performance management system ,o descend the 
aircraft. We had a difference of opinion on how best to accomplish this task (since we are trained to use all 
possible on-board performance systems). We wanted to use the aircraft's capabilities to its fullest As a result 
a late descent was started using conventional autopilot capabilities (vertical speed, maximum indicated 
mach/airspced and speed brakes). Near the end of the descent, the aircraft was descending at 340 knots and 6000 
fpm. The aircraft crossed the fix approx. 250-500' high.... This possible altitude excursion resulted because of 
the following reasons. 

First, the captain and F/O had differences of opinion ot. how to program the |FMC for) descent. Both thought 
their method was best: the captain's of programming (fooling) the computer to believe that anti-ice would be 
used during descent, which starts the descent earlier. The F/O’s of subtracting 5 miles from the navigation fix 
and programming the computer to cross 5 miles prior to LINDEN at FL 270. Second, Minor personality clash 
between captain and F/O brought about by differences of opinion on general flying duties, techniques of flying, 
and checklist discipline. Three, lime wasted by both captain and F/O (especially F/O) in incorrectly 
programming CDU and FMS for descent, which obviously wasted lime at level flight, which should have been 
used for descent (ASRS Report No. 122778). 
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In summary, we see that there is room for flexibility and blossoming of individualism even within rigid 
procedurization and standardization. Yet this requires a coherent structure of procedures and policies. If 
a given technique is not consistent with published procedure and stated policy, calling it a “technique” 
accomplishes little -- it is a dev iation from SOP, nothing more and nothing less. 

Having explored the various factors that influence the design of cockpit procedures, we shall next 
discuss the various issues in procedure design. Chapter 6 is largely an exploration of the many factors 
that must be considered in order to construct the appropriate guidelines. This chapter should illustrate to 
the reader the great complexity of procedure design, and the number of factors that the designer must 
take into account. In Section 6.2, we introduce the role of cockpit resource management (CRM) to 
emphasize that those who write procedures must keep in mind that many aircraft operations are 
conducted by several individuals (e.g., pilots, ground crew, etc.) working as a team. The procedures 
should support this approach, by building in teamwork, communication, division of labor, and clear 
specifications of "who does what. " 


6. ISSUES IN PROCEDURE DESIGN 


6.1 COMPATIBILITY OF PROCEDURES 

Philosophies, policies, and procedures must not be developed and designed without consideration of the 
operational environment in which they will be used. Commercial aviadon procedures, in this regard, are 
complex because of the ever-changing environment (weather, other traffic in vicinity, airport limi tation s 
etc.). In addition, the necessity to coordinate so many different agents and entities, which arc all 
involved in dispatching and maintaining control over the aircraft during flight, requires compatibility with 
the operational environment. When elements of the system, in this case the procedures, tasks, devices, 
equipment, are compatible, the process of conducting the task is more efficient - the pilots have to exert 
less mental and physical effort. We define compatibility here as the orderly and efficient integration with 
other elements in the system. We will now attempt to describe the basic structure of airline operations 
that may cause an incompatibility of procedures. 

6.1.1 Environment and Procedures 

Many cockpit procedures are dependent on the activities of external agents such as flight attendants, gate 
agents, fuelers, and others. When designing a procedure, the influence of these entities on procedure 
design, implementation, and task completion must be considered (Degani and Wiener, 1990). 

For example, one company s SOP requires a check of log books for open maintenance items prior to 
activating any controls or switches in the aircraft. The logic is that this check will prevent a flight crew 
member from activating a system that may be inoperative, thereby causing more damage (e.g., 
attempting to start an inoperative APU). At most stations, the aircraft log books are in the cockpit when 
the flight crews come on board. However, at some remote stations, due to maintenance procedures the 
log book is brought to the aircraft five minutes before push-back. Therefore the procedure cannot be 
accomplished in those remote stations. A change in the procedure, so that this information can be 
obtained from another source, or a change in maintenance procedure is required to defeat this 
incompatibility. 

Let us examine another example. One company was considering a change in their SOP so that flaps 
extension would be performed as soon as the aircraft leaves the gate. Pilots raised the concern of hitting 
a truck or other obstacles under the wing (as the crew cannot see the wing from the cockpit). Although 
the ground crew’s salute is an indication that all is clear, there was stili a concern that this gesture is not 
dependable. The argument was made that when a widebody leaves the gate, there arc many ground 
personnel around the aircraft. When a salute is given, the flight crew is assured that the area below the 
wing is clean. In contrast, when a medium size twin-jet is departing from a remote station, where the 
company has only a pan-time ground crew who may be less experienced, flight crews are less certain 
that a salute is truly an indication that all is clear. In one incident, a cargo can reached the aircraft after 
the salute, and the ground crew opened a cargo door. The only way the cockpit was aware of the 
intrusion was that the cargo bay light illuminated on the panel. 

These are two examples of what we call “system procedures.” The system in these cases involves not 
only the cockpit crew anc the aircraft, but also ground crew, their management, and ATC (handling ramp 
congestion and taxi clean nces). Such system procedures must be developed using a systems approach 
7 developing a common definition of the task and involving all the components of the system in the 
design of the procedures and policies. If system procedures are designed piecemeal, then the product 
may be an inefficient procedure, unbalanced set of responsibilities, and complicated dependencies - all 
are the foundations of a potential system breakdown. 

Compatibility between components in the system is not restricted to matching cockpit procedures to the 
operating environment; it can also be the other way around. For example, we once observed a flight in 
which the ground controller cleared the aircraft (a narrow body twin-jet) toward a runway intersection. 
The controder tried to schedule the taxi clearances so that the approach-end of the runway would be 
utilized by heavy jets, with smaller jets making intersection takeoffs. After the aircraft taxied to the 
intersection, the controller communicated to the flight to expect an intersection takeoff. The crew, 
however, insisted that they use full runway. The reason: the company’s policy prohibited the flight 


10 


crews from making intersection takeoffs. The controller, unaware of the company procedure, felt that 
the crew was unwilling to cooperate with him. The result was frustration on both sides, a long delay, 
and an inefficient taxi (back track on the active runway). 

In this case, the intentions of the controller were incompatible with the policies of the airline. One may 
argue that possibly ATC should be made aware of a company’s policies and resulting procedures that 
affect the efficient control of the aircraft by ATC. Likewise, one could argue for better communication 
on part of the captain -- explaining to the controller why he could not accept an intersection takeoff. 

Since there always be problems in matching procedures with the operating environment, we believe that 
over-procedurization will have an adverse effect on the practices, and consequently on the system 
outcome. A highly procedurized operation, as compelling as it may be, has disadvantages. It may 
provide a false sense of security, both to pilots and to flight management. Having too many procedures 
leads to an inflexible system, and generally results in some procedure being violated. It may lead to a 
creation of “classes” of procedures: some that are regarded important by flight crew and some that are 
not An example of a procedure usually regarded as unimportant by the crews is the xtqumtntni for the 
remaining pilot to wear his or her oxygen mask when one pilot leaves the cockpit above FL 250. 

Guideline U6: Care must be taken that not only the principal participants of a system (e.g., 
flight crews in this case), but also others that are affected (e.g., controllers, ground crews, 
cabin attendants) be involved and informed in the design and modifications of a system 
procedure. 

6.1.2 Type of Operation 

A somewhat different example of incompatible procedures, usually caused by the lack of a proper policy, 
is the effect of long- and short-haul operation on procedure usage. Pilots who fly short flight segments 
perform the normal flight checklists as much as 3-8 times per day and as many as 12-32 times on a 
typical trip. Pilots who fly long-haul flights perform their checklists significantly less. In addition, when 
foreign operations are involved, factors such as fatigue, lack of standardization of die ATC environment 
between countries, complicated navigation and communication systems, accented English on the radio, 
various transition altitudes, and mixtures of metric and English scales, result in checklists and procedure.* 
that are highly detailed. 

A requirement to conduct a very long and meticulous checklist procedure for short-haul operations may 
lead to compliance problems. For example, we observed the first officer of a twin jet who did not use 
the checklist the entire flight (a short leg of about 50 minutes). The only instance in which he used the 
checklist was after engine start. The twin jet checklist included many items that are there for sake of 
standardization with the widebody fleets of that carrier. While such a checklist may be efficient for 
heavy jets flying internationally and assist a dead-tired crew after a 10- hour flight, it is not compatible 
with the operation of a two-person twin-jet aircraft flying snort legs. The result is that some crews do 

not use it at all. 

Guideline #7: Procedures must be tailored to the particularities of the type of operation. 

Ignoring these particularities can foster low compliance with procedures on the line. 

6. 1 .3 Interface and Procedures 

Procedures are an integral part of the interfaces in the cockpit - specifying and dictating the actions by 
which the pilot is expected to interact with the machine. Procedures, therefore, must be compatible witn 
the interface. For example, the procedure which dictates the sequence of items to be checked on a panel 
in the cockpit (e.g., overhead panel) must be compatible with the layout of that panel (Degani and 
Wiener, 1990). In employing automation, it is particularly important that the task and procedure match 

the device. 

An example would be intercepting a radial outbound from a VOR. Ironically, it is a more difficult 
procedure in a glass cockpit than in a traditional model aircraft. Occasionally, aircraft departing Miami 
International for East Coast cities via Orlando VOR are given a clearance to intercept the 34 /depcc 
radial of Fort Lauderdale (FLL) outbound. There is no easy way to do this employing LNAV. The 


solution involves “anchoring” a “man-made” waypoint at an arbitrary distance (100 miles typically) on a 
bearing of 347 degrees from FL 1 1 . 12 

Guideline #8: The procedures designer must be mindful of the limitations and capabilities of 
the device he or she is designing a procedure for. Devices that are well designed for the human 
user require minimal procedurization. Less robust devices will require more thought on the 
part of the designer, and will probably require more complex and lengthy procedures. 

Electronic checklist displays are highly demanding of compatibility between the procedure and display 
The first generation of electronic checklists is currently installed in three air transport aircraft (A-310, A- 
320, and MD- 11). With respect to procedural modifications, these systems arc inflexible because the 
customer cannot easily modify the items which will appear on the electronic checklist display, or even 
their order of appearance. For example, one of the procedures in the electrical checklist system is quite 
cumbersome when performed at a low altitude. To combat this, one airline devised a procedure called 
the “mini checklist.” 

If engine failure occurs at low altitude and landing is imminent, the ECAM procedure, if sequentially followed 
results in turning off various equipment, reactivating the hydraulic system, and then turning ON much of the ’ 
same equipment that was just turned OFF. To preclude this, and streamline the procedure, a good technique is 
to turn ON the green electronic pumps and the appropriate PTU shortly after engine failure in order to reactivate 
the affected hydraulic system and eliminate much of the ECAM procedure. It is also a good technique to start 
the APU to provide electrical backup. Commonly used terminology is to call for the “mini-checklist” which 
consists only of restoring the hydraulic system and starting the APU as noted above. (If an engine fails during 
takeoff, do not call for the “mini-checklist” until after calling for flaps up). 

The mini-checklist is a paper checklist which is kept in the cockpit. It lists several items for restoring the 
hydraulic system and starting the APU. The “mini-checklist,” therefore, is a form of adaptation in 
human-machine systems. A task is tailored,” or modified, by the human operator to accommodate a 
constraints imposed by inflexible devices (Woods and Cook, 1991). This adaptation is required because 
the modified procedure cannot be supported by the existing electronic checklist. The consequences of 
such inflexibility are that the pilot is required to conduct a procedure (mini checklist) on top of another 
procedure (ECAM), in order to execute the task. Note that both procedures discussed are performed in a 
highly critical and workload-intensive situation - restoring an essential system after an engine failure at 
low altitude. 

6. 1 .4 Aircraft Systems and Procedures 

A procedure that details how to operate a particular sub-system must be compatible (or correct) in terms 
of its procedural steps, actions, and flow. The following examples will show how much the procedural 
designer must be attuned to the engineering aspect of the device (or sub-system). One company’s split- 
flap procedure had to be re-written when it was found to be wrong. The problem was traced to the fact 
that system components that were powered by the standby power unit were different from the standard 
configuration for this model aircraft. The airline apparently did not keep a good record of its own 
electrical system specifications. Such problems, however, are not unique only to airlines. During Space 
Shuttle Mission 49, the crew of the orbiter Endeavor tried r o deploy a rescued satellite (Intelsat). The 
primary and backup deployment circuits would not send power to the cradle holding the satellite. 
Investigation showed that the checklists used in Mission Control and on Endeavor were identical to 
those on the other three NASA orbiters. But the problem occurred when circuitry for Endeavor's wiring 
was engineered differently and the checklists were not changed to conform with the new orbiter's 
design. The problem was finally overcome with the help of engineers in Ground Control (Aviation 
Week and Space Technology , 1992a, p.79). 

Likewise, there may be wide differences in aircraft configurations within a given fleet. This sets the 
stage for the possibility of using an inappropriate procedure in some models. This is particularly true if 


1 1 °!? ta P uin thal * c interviewed remarked that the 757 (and other glass aircraft equally so) is “a good lo* airplane, but a 
poor ’from* airplane.'* K 

* £ s r ,ar incom P alibil ' , y i* 131 requires a cumbersome procedure is the task of intercepting a jet airway in a 757/767 
FMS. The procedure requires some 6 steps and two mode changes. 


32 


there are a small number of “cxld ball” aircraft within the fleet. In designing procedures for such a mixed 
bw coffi C ^ratioi)° n mUSt 66 takCn rcgarding sub ‘ systcms 1,131 m invisib,c to the pilots (e.g., electrical 

Guideline #9: Management must guarantee that any procedure is compatible with the 
engineering of the aircraft or any sub-system. Care must be taken when there are subtle 
differences between aircraft (especially if these differences are invisible or difficult to detect). 
Incompatibility can be resolved either by re-engineering or procedure. 

6. 1 .5 Cockpit Layout and Procedures 

instances of incompatibility of procedures with the ergonomic layout of the flight deck. 

STterfflK * "\ mple - Traditionally, gear and flap/slat levers were mounted 

ihJ ght i de °[ the cockpit) - . Tbey not within easy reach for the captain in 

the cockpit of a widebody airplane. In most U.S. airlines the captain and the first officer rotate the duties 

J ying (PP) a J d P i,ot not flyin g (PNF) during a trip. If the first officer is the PF, the SOP 
usually dictates that the captain raise die gear and flaps/slats after takeoff. To do this, the captain must 

" H gl h K l ° f the tbr ottle S uadrant to grasP ^e gear or fiap/slat levels). In several aircraft cockpits, 
specially widebodies, the captain cannot see the flap/slat detents very well and he or she can also 
accidentally push the throttles rearward. The same error may occur when the first officer as the PF 
'^f_ nl f ^ t f ? use the speed-brakes located to the left of the throttle quadrant. Note that this incompatibility is 
due to the operational philosophy of most U.S. airlines that encourages rotation of pilot flying duties In 
contrast, jn some foreign airlines PF duties are not rotated every leg. For those airlines this 
incompatibility does not exist. ’ 

There are two approaches for solving this incompatibility: (1) procedural, and (2) hardware. 

1 ' fS^S argUC< J since ? e C0 P k P' t ,ayout cannot ^ changed (within reasonable boundaries 
of cos efficiency), the procedure should be changed so that when the first officer is the PF he or 
she will retract/extend the gear. 

2 ' It™™' W f U tl th f C D ° Uglas D f'!°’ designers of the MD- 1 1 located the landing gear lever in 
the middle of the fonvard panel. It is within equal reach-distance for both the captain and the first 
officer. Likewise, the designers of the Airbus A-320 eliminated a portion of this incompatibility 
by placing the speed brakes and flap levers on the pedestal between the two pilots* 

Note that both die MD- 1 1 and A-320 aircraft were designed during a different social era than their 
predecessors. Social culture has affected the airlines’ philosophies of operation (a flatter cross-cockpit 
authority and role gradient), the airlines’ policies (rotation of PF duties) and has thereby affected ^ 
associated procedures (gear extension by PNF). To accommodate these philosophy, policy, and 
procedural changes, the cockpits were designed differently. Not surprisingly, there is greater 

Techrwlogy °992b) CS nowadays ,n the design phase of new aircraft ( Aviation Week and Space 

Guideline #10: Airframe manufacturers and component suppliers (such as avionics firms) 
must be attuned to general airline procedures. Knowledge of such procedures may influence 
ergonomic considerations. 

6. 1 .6 Paperwork and Procedures 

Documents, manuals, checklists, and many other paper forms are used in the cockpit. The compatibility 
between the procedures and their associated devices (manuals, checklist cards, etc.) exerts an effect on 
procedure execution. Ruffell Smith ( 1979) reported that excluding aircraft flight manuals the amount of 
paperwork needed for a flight from Washington D.C. via New York to London, had a single side area of 
200 square feet. Interestingly, the 15 years since Ruffell Smith’s study have not yielded any reduction in 
repon t ) PaPCrWOrk thC conlrary ’ ^ prob,em has °n!y intensified (as evident from recent ASRS 
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On August 19, 1980, a S^di Arabian Lockheed L-101 1 was returning to Riyadh Airport (Saudi Arabia), 
after warnings in the cockpit indicated smoke in the aft cargo compartment. The crew was searching for 
the appropriate emergency procedure in their flight documentation. The accident report stated: 

About 3 minutes were spent by the crew looking for the aft cargo smoke warning procedure. Evidence indicated 
this difficulty was due to a split of the Emergency and Abnormal procedures into Emergencies, Abnormal, and 
Additional (sections). The crew apparently believed that the procedure was in the Abnormal section when it was 
actually in the Emergency section. ( Flight Safety Focus, 1985, May) 

This, and several other factors led to a horrific accident in which 287 passengers and 14 crew members 
died of fire and toxic smoke inhalation. During one cockpit observation, we noticed a similar problem in 
locating the proper procedure: 

While the aircraft was taxiing to the runway, die "Hydraulic RAT Failure" warning appeared on the aircraft's 
system monitoring display. The concern was whether the ram air turbine (RAT) was unlocked and hanging 
down from the bottom of the aircraft The crew, aware of a known problem with a sensor, anticipated that this 
could be a false warning, and expected that the warning would disappear during taxi (and it did). As the aircraft 
<aari<vt the takeoff roll the warning appeared again. The captain decided to abort the takeoff and work on the 
problem. However, he could not find the written procedure that specified how to verify this condition. 

There were five places where such procedure could be listed: (1) the Right Operational Manual, (2) the 
Supplemental section in the flight manual, (3) Operations Bulletin, (4) the aircraft newsletter, and (5) on the 
dispatch paperwork. The procedure could not be found in any of these. An attempt to find it using an index 
failed - there was no index in the manual. The captain called the local station and asked them to read it to him 
on the radio. They could not find it either. After waiting for several minutes, he decided to conduct the 
procedure from memory - a violation of a company policy that requires that procedures must be conducted from 
the book and not by memory 13 . 

Clearly, the standardization of books and manuals is important for fast retrieval of information, 
procedural execution, training, as well as compliance. We believe that a consistent criterion for which 
procedure goes into what book, and where, is essential. For example, one company’s push-back ^ 
procedure was listed in a manual that included personal appearance policies ( haircuts and shoe shines, 
as they are known by the pilots). 

As stated earlier, one of the beneficial “side effects” of standardization is that it may aid in transition 
training. A well defined and logical organization of manuals and books can yield such a dividend. 
Kyllonen and Alluisi further noted, “The hierarchy characteristic of memory organization is a feature that 
can be exploited in designing learning materials. It has long been known that humans find it 
considerably easie> to remember materials that have a built in organization structure, and easier yet if that 
structure is made quite apparent” ( 1987, p. 126). For example, one company has invested a 
considerable amount of resources in a standardization of its procedures and manuals. The concept was 
to provide an aircraft publication policy manual in essence - a “style book,” that specifies the outline, 
format, general rules, checklist names, and standard text to be used in all the company’s aircraft 
publications. This would include the cockpit operating ma.nal, aircraft operating manual, performance 
manual, weight manual, quick reference manual, and Si takeoff/approach data cards. The company also 
attempted to standardize, using the same process, all the procedures used by the airline. Although this 
huge project is far from complete, it has already yielded fruit: many flight crews stated that flight-deck 
documentation is now well standardized. Moreover, they felt that by launching the procedure 
standardization project, the company was making an effort to support them in their daily task. As the 
project continued, the pilots' perception of the SOP as a useful and well thought-out tool became more 
entrenched. 

Guideline Ull\ The entire documentation supplied to the cockpit (and elsewhere) should be 
regarded as a system, and designed accordingly as a s, stem, not a collection of independent 
documents. A clear and logical (from the user’s view) structure for this system and a criterion 
for the location of different procedures is important. An effective index in each manual would 
go a long way toward aiding pilots in finding materials they seek, especially when it is an 
unfamiliar, obscure, or seldom accessed procedure. 


11 These deficiencies have since been corrected by the airline. 
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6. 1 .7 Computerwork and Procedures 

Proced u re s dictate tasks, and often these tasks involve some form of transformation (e.g., converting 

!j *" metei ? I to * etnn S lhe altimeter in feet). A complex transformation be^veen input and 

fnvheerar S fSin °* ° ad ’ cre . ate , P osslble i° nf “ slon > f9 uirc procedural aiding, and worst of all, 
invite error. The following example illustrates the effect of a complicated transformation. 

The crew of a B-757 preparing to fly from Miami to Washington National, was dispatched with a 
computer-generated flight plan with the following route: “radar vectors, AR-1 CLB ILM J-40 RIC...” 
Pin a t tem P ted to enter the flight plan into the Route page of the CDU, they got no further than 

^ tCd m an 6 u° r messa 8 e of “ n ot in database.” They reputedly tried to enter 
rf R rr n iS/£ d co " 0nued to ^ ceiv . e th ? same message after entering CLB. Whatwas the problem? 

bea f° n ’ not a u y OR as ^ three-letter designator on the flight 
KTri » g n P ’ ^ C ?T CCt and com P at,ble with the “expectations” of the CDU should 

1 W3S n0t Una i! be crew took out then - paper charts and traced the route that the 
error in the flight plan was apparent (Wiener, 1 989). 

If the same computer-generated flight plan had been issued to a non-FMS aircraft, there would be no 
such incompatibility. But that is exactly the point - documents must be compatible with the equipment 
they support. If an efficient operation is desired, the transformation between the input task and the 
task sh ® uk J be ke P l ® m Plc.ln this case, there should have been a direct mapping between the 
data entry task (CLB from the flight plan) and the output (entering the NDB into the CDU). 

Guideline #12: Paperwork should be designed carefully to be compatible with the device for 
which it is intended. Particular care should be exercised in preparing materials for computer- 

based systems. It may be necessary to provide differently formatted documents for different 
cockpit configurations. 


6.2 CRM AND PROCEDURES 

Effective execution of procedures in a multi-person crew depends on effective crew coordination and 
resource management (Wiener, Kanki, and Helmreich, 1993). Although the term CRM is widely used 
to describe many aspects of human-human interactions, including team-building, social interaction 
s^dfied task C ^ dlscusslon here is limite d only to the crew coordination aspects of performing a 

6.2.1 Crew Coordination 

One of the objectives of any procedure is to promote better coordination among crews. The term crew is 
expanded here to include all agents that are involved in performing a task (e.g., the push-back of an 
mrcraft from the gate requires that the ground crew and the pilots work together). For that duration, all 
l‘f agentS Inv « lved ‘ n Performing a task (e.g., ground crew, ground controller, cockpit crew, gate 
bfall t^agemffnwlve^ “ 3 CrCW ‘ 71,6)56 system Procedures, accordingly, are shared and conducted 

crorSnation Vera ^ attributes of a P roceclurc that can be utilized by the designer in order to promote crew 

R educed variance. Procedures trigger a predetermined and expected set of actions. There are 
several benefits resulting from this: 

1 . SOPs allow “freshly formed” crews, often comprised of individuals who have never previously 
met, to effectively and efficiently discharge important operational tasks with minimal need for 7 
formal co-coordination and superfluous communication” (Johnston, 1991; Hackman, 1993). 

* ' ageinU^'in^he crew* 0 *^ r °^ eSS ° r in ‘ coming ,asks aI,ow for cas ' cr monitoring on part of the 
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3. The procedures allow the other agent(s) to plan and schedule their own actions/tasks in parallel to 
the procedure(s). 

4. They set a defined standard of performance that allows all crew members to continually compare 
targets (inputs) with actual performance, thereby providing all crew members with a baseline for 
questioning and correcting substandard performance on part of other crew members. 

Feedback. SOPs specify expected feedback to other crew members (e.g., callouts). This feedback 
can detail (1) the cuirent, and/or expected system state; (2) the actions that are currently being conducted; 
(3) the system outcome; and (4) an indication of task completion. 

There are several ways in which this feedback is provided: (1) verbally (callouts, callback, etc.); (2) non- 
verbally (gestures, manual operation - such as pulling down the gear lever); (3) via the interface (when 
the configuration of the system is significantly changed, e.g., all CRTs are momentarily blank when 
power is switched from APU to engine-driven generators, this provides clear feedback to the other pilot); 
and (4) via the operating environment (when slats/flaps are extended during approach, there is a clear 
aerodynamic feedback -- pitch change). 

Information transfer. Procedures convey, or transfer, information from one agent to others. In 
designing tasks, procedures, and callouts, the designer must make sure that no information is lost and 
that no noise u is added into information channel. Care must be taken with specifying non-verbal (para- 
linguistic) communication, as this form is usually less precise, difficult to standardize, and subject to 
misinterpretation (Wiener, 1993). Noise can be added when an ATC call, or a flight attendant, interrupts 
intra-cockpit communication during high workload periods. One system goal is that the same amount of 
information that is sent by one agent will be received by the other agent. When procedural requirements 
are violated by the agent transmitting the information, e.g., the example of the first officer's takeoff 
callouts of “V one- r, two of ’em” (Section 3.2.1), one can say that another form of unwanted noise (a 
deviant callout) has entered into the system. 

Why are these attributes important? Because the designer may want to consider them while designing a 
procedure for a certain task. The procedure designer should design the feedback and information 
transfer aspects of the procedure in a way that will accommodate the requirements of the task. For 
example, if the designer decides that a procedure is critical (e.g., CAT II approach), he or she may 
decide to employ all possible forms of feedback into the design in order to safeguard crew coordination. 

As for information transfer, understanding how information can become distorted allows the designer to 
provide safeguards to reduce their likelihood of occurrence. The procedure and the other tasks 
conducted at the same time should be designed so as to minimize noise and losses. For example, 
information can be lost when a completion call, such as “the after takeoff checklist is complete," is 
mumbled by the PNF. In our previous study we recommended that the completion call of the checklist 
should be made an item in the checklist (Degani and Wiener, 1990). 

Each of the above forms of noise, when introduced into the system independently, would probably not 
lead to a sub-optimal performance. But as it usually happens in a system accidents, the interaction 
between several of such sources of noise (e.g., a not-per-SOP rotation callout and an interrupting ATC 
call) and possibly other active failures (e.g., engine failure during rotation) may lead to sub-optimal 
performance (Perrow, 1986; Reason, 1990). The designer cannot foresee each possible combination of 
distraction and unwanted interaction. The designer has no choice but to laboriously contain each source 
of noise independently. When the source is internal to the aircraft and company, containment is not 
difficult (e.g., sterile cockpit rule), but if it is external (e.g., ATC), it is far more difficult to control. 

The issues of reducing variance and enhancing feedback and information transfer allows us to analyze 
the interaction between critical tasks and technique via the eyes of CRM. When the aircraft is in a critical 
phase of flight, such as during approach or takeoff, there is no time to be creative with individualistic 
technique. At that point it must be strictly procedural -- not even a slight ambiguity among the crew how 
the task is conducted. Procedures minimize variance in pilot performance and therefore allow the other 


14 Note that in this section we are using the term noise in the electrical engineering sense •• meaning anything that 
distorts or degrades the signal or informalio 
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pilot a much easier monitoring task. Technique, with all its value, does introduce a font! of variabilitv to 
rcw coordination (m both feedback and information transfer). Nevenhe!es”^chmqTscan^ y 
positively introduced during all other phases or tasks. 

Guideline #13: Procedure design includes intra-cockpit communication. The expected 
prwedure 3110 " Sh ° U d be specified * trained > to standardization like any other 

6.2.2 Sharing of Information 

H^i ly ’ 311 ,nfo ™ a } 10 K n r is shared and known to all crew members (Orasanu, 1993) Nevertheless this is 

KS. S f”™ 0 " “> * s "r* Via S0P ' as "» of iHforTmn can t 

^rmous. In defining the task and the procedure, the crew coordination attributes must be also defined 
TTte deMgner should determine the level of awareness required of other crew members about the task by* 

1 ‘ raS rfXYZVOR)r mber<!) k " OW aU the de,ailS 01 ,he ,ask <fly head “'8 280, intercept the 050 

2 ' know ia gc " eral !he sys,em is confi8urcd acCMdi "8 “ 

3 . Should the other crew member(s) just be aware that the task is being taken care of (or under 
control), but not necessarily its exact state (walk-around)? 

4 ' 55® cnp a T t u ee . d £°n th u other f ew members) to know about the task when it is part of some 
else s SOP (that all flight attendants are ‘‘buckled in” prior to takeoff)? F 

Another fonn of information sharing is a briefing. For example, during a landing briefing the crew i<- 
briefed on the published procedure, landing category that will be used, limitations etc as 8 well as 

,he “rproacManding ti.sk (weather, captain’s mtnimums, 
EXIIfi , ' tc ) ; Bnefin g. fr om a procedure development point of view can therefore be 

d ^ n . bed as a ? sk that assembles and coordinates a set of procedures in order to “ground” the 

ESaSS Situati0n - Briefing is provided to the ‘ a * k in order 

to racilitate transfer of information, to increase expectation, and to allow for better feedback. 

nr!Jw£«!S! l ~ Sectio . n 5 ’ 6, auloma i ted cockpits cannot be procedurized as completely or easily as their 
ttf .? Cn ^ a °P erati ng policies, recommended techniques, and individual techniques 
substitute for this. However, all lack the “reduction of variance” attributes of a procSure hi managing 
flight path in automated cockpits, briefing becomes an critical crew coordination^ - not so mIS to 8 
reduce variance, but rather to reduce the level of ambiguity in the minds of theo^crewmem^rebv 
clarifying expectations. The more one allows for technique, the more one has to stre^briTfing Y 

‘ £?!?* re **** m ™y instances in which in response to the challenge 

“smSd ” Th £ erSOn respo f ns ; ble for tbat “ sk < usual ly ‘he PF) would merely respond with the term 

“as uS” Bai^nnX 8 21^“ there W3S T* 1 '" 8 t0 briefabout as the forthcoming task was 
as usual Based on the above discussion, we argue here that in a critical phase of flight such as takeoff 

or landing, there is no such thing as standard, and that a briefing (possibly very short but still of 

PT dUr 7’ etc ) ; is a,wa y s ret i uircd - The use of “standK p lace 5 a proper 
briefing, may be regarded as a form of complacency. ” P ^ 

Guideline #14: In managing automated cockpits, briefing becomes an critical crew 

of " pmS variance - but rathcr t0 reduce the level of ambiguity 

rerhn h inn^ 8 f5 m^ 8 , PN u 0r F/0) b > wcreasing expectations. The more one allows for 6 
technique, the more one has to stress briefing. 

6.2.3 R( iuction of Ambiguity 

As our definition of procedure implies, a procedure should never be vague. Generality is a desirable 
attribute of a policy or a philosophy, but not a procedure. Procedures must ^•buX? P ^f * ag^nst 
vagueness, as vagueness violates one of the most important by-products of cockpit procedures? 
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coordination of tasks between agents. If the same SOP, used in different situations, yields a 
significantly different outcome, then this should raise a warning flag to the procedure designer. The 
following example illustrates such ambiguity. 

The SOP for starting engines of a twin-jet for one U.S. carrier is for the ground-crewmember to call the cockpit 
and say, “Geared to start engines.” During line operations, however, most experienced ground-crewmembers 
will give this clearance per a specific engine, i.e., “cleared to start No. 1 ,” or “cleared to start No. 2.” It is 
preferred to start the No. 1 (left engine) fust, because the bags/cargo are loaded from the right side of the aircraft. 
Another reason for this sequence is (hat the tow-bar pin is extracted from the right side. Therefore, it is 
recommended not to have the right engine operating while the ground crew is disconnecting the tow bar. 

In one reported incident a ground-crew trainee called the cockpit and told the captain “cleared to start 
engines” (exactly as SOP dictates). What he should have said was “cleared to start No. 1,” as other 
ground crews were loading bags on the right side of the aircraft. The captain later stated that the callout 
“just did not sound right.” He did not start the engine and called the ground crewmen to verify if he was 
cleared to start any engine, or just one of them. 

The procedure, apparently, led to an ambiguous situation. As our definition of procedure in Section 
2.1.1 stated, the outcome of a procedure must be a product which is unambiguous to all agents involved. 
If the same procedure can yield significantly different outcomes, then the procedure must be modified or 
changed (e.g., “Cleared to start engine number [one, or two]”). 

Likewise, in spite of the best efforts of standardization departments, flight crews can also make a 
procedure or callout ambiguous by taking shortcuts. We observed a captain who, upon being given a 
heading, altitude, and airspeed to make good while descending for a landing at San Diego, replied to 
ATC, “We’ll do it all.” Note that by not repeating the information, he ^hort -circuited the checking 
process, denying both ATC and his fellow crew persons the opportunity to be sure that he operating on 
correct information. 

Guideline HI 5: If the same procedure can yield significantly different outcomes, then the 
procedure must be modified in order to eliminate its embedded ambiguity. In brief, a 
procedure should lead to a totally predictable outcome. 

6.2.4 Resources and Demands 

If the procedure places an unrealistic demand on the crew, then some pilots will very quickly develop 
creative “tricks” to bypass these procedural restrictions. These creative “tncks” may be even more 
dangerous than the situation which the procedure attempted to regulate. For example, ACARS push 
back time is sensed automatically when the captain releases die brakes. This information is then used to 
determine on-timc performance. To bypass this, some crews have developed a technique in which they 
release the brakes and then set them again before they are ready to go, so that the push back signal will 
enter into the ACARS. Besides the fact that the crew is deliberately falsifying data, if this practice is not 
well coordinated with the ground crew, it can result in an injury. 

In summary, all the above design issues cannot be extracted from the system by management only. The 
awareness and cooperation of flight crews is required in order to point to an existing problem. A formal 
feedback loop, such as previously advocated in Section 3.2.4, should be in place to obtain, collect, 
analyze, and rectify problems encountered on the line. 


6.3 CALLOUTS 

Callouts are aids in maintaining awareness of the crew as to the status of given tasks. They are 
extremely important in aiding situational awareness of a dynamic task, such as flight-path changes, 
engine starts, etc. There are several advantages and disadvantages to this form of status reporting. It 
allows the controlling entity to have full information on the status of each system component. Likewise, 
each component in the system also knows the state of other components. This, however, is purchased at 
a price - constant chatter. But even repetitious chatter is not always a disadvantage, as the experienced 
human operator may detect departure from the monotonous sing-song as an indication of a problem 
starting to develop (Rochlin, La Porte, and Roberts. 1987). 
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Sing-song reporting methods are not cost-free: they place a burden on the pilot. His workload increases 
and his attention may be reduced. Nevertheless, they make the system dynamics appear more discrete 
and therefore more manageable and comprehensible. An example of SOP sing-song is engine start 
callouts. Most companies specify a sequence of callouts that help the crew monitor the process of engine 
start and detect abnormalities. Apparently, the level of detail in some companies' engine-start procedure 
for a two-pilot cockpit was borrowed from a three-pilot aircraft in which the F/E calls out information 
that is not easily accessible to the FAD and captain (e.g., “start valve open"). Some have argued that the 
amount of detail in this procedure can be reduced, as both pilots are monitoring the engine instruments in 
front of them. 

Another method for status reporting is called “by exception.” Using this method the pilot makes a callout 
only if the system has deviated from the assigned parameters. Its weakness is analogous to problems 
with remote sensors. In the absence of an alert, one of the tw o conditions can exist: (1) the system is 
within limits or (2), the sensor failed (and the system may be out of limits). 

When specifying the method, the script, frequency, and sequence of callouts, the designer should 
consider the following: 

1 . If the task duration is long, a sing-song method may not be appropriate, as it will overload the 
pilot. In this case a “by exception” method may be more efficient. 

2. If the system is highly dynamic and unstable, a sing-song method is preferred. If the system is 
temporal and predictable, exception reporting may be preferred. 

3. If the task requires a high level of monitoring while other tasks must be accomplished, a sing- 
song may be preferred. However, this must also be designed with economy of information 
processing involved. We have seen one company’s callouts on low visibility approaches which 
are so demanding that the PNF almost never stops talking for the last 1000 feet above ground. 

4. If the state of the primary task is in front of the entire crew, as opposed to being hidden from 
them, exception reporting should be considered. 

Proper sequencing of callouts is also an important design aspect. One concern in control of dynamic 
systems is that status reports will overlap in time, overloading the reporting channel and leading to a 
situation referred to by some operators as “control chaos.” To avoid this, military organizations spend 
considerable effort to sequence these reports properly - especially when the system is ir. an 
abnormal/crisis situation. 

One airline has recently changed its non-precision altitude callot’t sequence because of this problem. The 
SOP stated that the crew make a 500 foot AGL callout. In addition, SOP stated that a MDA callout 
should also be made. Since many MDA’s are around 480 feet AGL, this created a sequencing problem. 
As a result, the requirement for the 500' AGL was removed 15 . 

We believe that callouts should be examined like any other procedure. They should be economical, 
unambiguous, and should convey only the information needed by the other crew members). 

Quantitative calls should be used if necessary (“1000 feet, sink 5”). Qualitative calls (“on profile”) arc 
economical of both the sender and receiver and can be used for normal conditions where precise 
quantitative information is not needed. Callouts by exception can be useful in their place (e.g., no call if 
on localizer and glideslope). 

Finally, the designer should resist the temptation to create a “cattle auction” which may allow the PNF to 
drown the PF in callout information (especially a sea of numbers). This may also reduce the PNF 
situational awareness and his ability to backup the PF. Complex callouts may sound precise and give the 
impression of being professional, but actually convey little usable information. In fact they may obscure 
vital information. For example, one carrier required callouts at various altitudes on final approach to 
include altitude, rate of descent, and deviation from seleurd (bug) speed (e.g., “500 feet, sink ten, plus 
rifteen”). The PNF never stopped talking throughout the approach. 


15 Note that the MDA callout is more critical than the 500 foot AGL callout, as the MDA callout is associated with a 
control action (level off at the MDA and proceed inbound). See Sections 7 I and 7.2. for a discussion on this issue. 
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Similarly, it has been a common practice (yet not a mandated procedure) in another earner for the PNF to 
call out heights above touch down as the aircraft approaches the runway. The concern was that by 
making these frequent callouts (100, 50, 40, 30, 20, 10, feet above the runway) the PNF must focus 
SheSing ra< ”° a timetcrs ( heads down), and not on his primary task -- backing up the PF during 

Guideline #16: Particular attention should be paid in order to safeguard information transfer 
during critical and high workload phases of flight. Callouts should be economical, 
unambiguous, and should convey only the information needed by the other crew members), 
rhey should not distract the crew m .ber from his primary task(s). Finally, we urge frequent 
review of callout procedures: as othci procedures change, callouts should be reexamined; 

6.4 PROCEDURAL DEVIATION DURING AN ABNORMAL SITUATION 

The discussion up to this point has focused on procedure deviation during normal operations. There are 
procedure deviations during emergencies too. The topic of procedures, in general, always brings about 
the question of when is it permissible to deviate from them. Is it permissible to deviate from a low 
pruwity procedure (e.g., after takeoff checklist) when, due to high workload induced by an abnormal 
condmon (electnca failure and a IFR missed approach), it cannot be performed (Wiener, et al. 1991)? 
The answer is clearly yes: procedures were designed remotely from the situation at hand, and 
occasionally u is necessary to deviate from a procedure. As we have said before, procedures are in place 
to aid pilots, not to enslave them. v 

It is the nature of any goal-oriented system that the system goal, e.g., making a safe landing/evacuation 
malfunction, is always high ghted, not the process by which it is achieved. We assume that 
if the process is valid, then the result will be too. But that assumption is not always true. If a pilot 
S'f»I eS “ om Procures, training policies, or even regulations, but saves the day, he or she is a hero, 
“j| t !? ,s a J.°J. °* ^ about the flexibility of the human. On the other hand, if the pilot fails, he or she 
can be charged for deviation from basic operating procedures and discredited, or worse. 

This paradox will always exist in any goal-oriented system , particularly if it operates in a dynamic and 

H£KL COU if *2 ?' avir ? nme " t Therefore it is important that management make a stand on this paradox via 
policies and philosophy. We have previously stated that one goal of management is to minimize 
deviations from procedures. In an emergency, such deviations must be accepted. The following ASRS 
report speaks to that issue and summarizes, via an example, the discussion of this chapter. 

While cniising at FL280, the left engine flamed out. Two unsuccessful attempts were made to restart the 
CTgme. Aircraft was landed at Cedar Rapids Airport 13,000 pounds over weight (143.000 pounds gross weight). 

The Ume elapsed from engine failure to landing was almost 30 minutes. During that time, the workload on a 2- 
person cockpit is tremendous. Communication with ATC, night attendants, passengers, and each other, leaves 
little ume for through analysis of aircraft problem itself. Our checklists are more directed to engine failure at 
takeoff, or shortly thereafter, with almost no guidance on priorities at altitude. So many books to check for 
single engine alutude drift down speed, failure checklist, maximum over weight, landing weight for runway 
available, restart checklist, and normal checklists. Although I had my own written [italics added] rough guide 

216283) S,UiaUOn f ° Und U nccessary 10 revise man y i,cms in ,i 8 ht of m y experience. (ASRS report no. 

We pass now from principles of procedure design, and factors that must be considered, to a discussion 
about the task of designing procedures. Chapter 7 lays out an orderly, comprehensive method for die 

i^ U hiv^ S ?^ Ct,< r ° f and in Section 7.4 the implementation of procedures, something 

we have not emphasized in previous chapters. The difficult question of standardization, both within and 
across fleets, is attacked is this chapter. Numerous examples from database searches and from our own 
experience in the jumpseat illustrate the points. 
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7. DESIGNING PROCEDURES 


7.1 OBJECTIVES AND STRUCTURE OF PROCEDURES 

In general, execution of tasks can be viewed as the transition between current state (e.g., before engine 
start checklist is complete) and target state (engines have been started) in order to achieve the objective. 
To support the crews in performing the task, flight management must determine what is expected from 
the crew in terms of task performance. A set of different “methods,” (e.g., mandatory procedure, 

recommended technique, and policies, etc.), are then introduced to aid the pilots in making the transition 
trom current to target state. ° 

7.1.1 Objectives cf procedures 

The designer must identify and list all the procedure objective(s) before plunging into the details of 
procedure development. He or she must determine, exactly, what the procedure is trying to establish 
For example, are checklist procedures designed as an aid for a “dead tired” crew which flies an 
international route . Or, are checklist procedures developed as only a minimal “killer items” list 9 
Although the apparent objective of the checklist is the same (to configure the aircraft properly) the 
interaction with either of the two objectives will yield dramatically different checklists. 

Consider also the following example: Most airline SOPs require that a callout should be made 1000 feet 
before the assigned altitude. The purpose of this callout is to increase crew awareness prior to an event 
(level-otf), that if not conducted properly, may have an adverse effect (altitude deviation) TTie most 
common practice is to call out “one thousand to go.” This callout, however, fails to transfer critical 
pieces of information which bound the level-off task: the target altitude, the current altitude, and the 
direction (cUmb/descent). The real objective of the task is not just the level-off maneuver, it is also to 
level-off at the assigned altitude. The procedure and callout should therefore include both 16 . One 
airline, in an attempt to curtail altitude violations, dictated the following procedure “PF will verbalize 
leaving the altitude 1,000 feet prior to an assigned altitude. Not 'one to go’; rather ’six thousand for 
seven thousand or flight level three zero zero for two niner zero.” 

7.1.2 Who is the Target Population ? 

At first, the answer to the above question may seem trivial - the pilots. But a closer examination will 
reveal that there are several sub-populations within a company’s pilot population. Are the procedures 
designed for the line pilot who has been flying the same aircraft for 15 years? For the pilot who iust 
transitioned from a traditional cockpit to a glass cockpit aircraft? For a new hire who occupies the right 

seat in a DC-V. Or are they designed according to the capabilities of the seasoned chief-pilot who 
designed them? r 

Forexample, one airline’s current rejected takeoff (RTO) procedure allows the first officer, when acting 
as PNF, to call for and, when he or she is PF, to conduct the maneuver. This procedure, however is * 
currently being revised. The future RTO procedure for this airline will allow only the captain to perform 
this maneuver. There were several factors that led the airline to change this procedure. One was the 
belief that a new first officer of a wideboay is not experienced enough either to perform orcall-for this 
complicated and extremely hazardous maneuver. In this case the company has made a decision to change 
pilo^^pulation* ^ W * accommo ^ ate thc perceived abilities of the lowest proficiency level in the line 

To summarize, the definition of the target population must be developed, tested, and agreed upon prior to 
designing the details of a procedure. Once this component of the operating philosophy has been 
determined it must be communicated to all pilots in the company. 


** Note that the thousand to go" callout is also an example of a loo general and somewhat ambiguous SOP - the same 
procedure yields significandy different outcomes (see Section 6.2.3). 
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7.1.3 Structure of Procedures 


As mentioned earlier, it is common in all high-risk systems that critical tasks that affect the goals of the 
system are always accompanied with a set of procedures. Procedures, in turn, specify a set of sub-tasks 
or actions to be completed. That is, each procedure can be shown to lie between a higher level task and a 
lower level sub-tasks. Figure 10 shows this structure. 



Task: Configure for Landing 


Task: CAT III approach 



Action: 

Action: 


Start switches. 
Speed brakes. 



Actions 


Actions 


Actions 


Figure 10. The task-procedure structure. 

The normal tasks and procedures that are required to fly a passenger aircraft can be arranged in such a 
hierarchtctd manner possibly starting with a high level goal of flying passengers from point A to B, and 
then branching out to phases such as ground phase at departing airport, airborne phase, and ground 
phase at destination. This is followed by a third level, that includes functions such as preflight, boarding 
passengers, engine start and push back, before taxi, etc. The fourth level includes tasks such as starting 
engines, configurauon of various systems, etc. The fifth level includes the various actions such as 
setting switches, tuning radios, monitoring a gauge, etc., that are necessary to perform the task. 

The task -procedure hierarchy allows the designer to structure the procedures in the context of the 
overlying tasks, functions, and the phases of flight. Such decomposition is a proven way to manage the 

3 eX ^o n 0 n V n d m human ™ chine s y stcms < MiIler . 1985; Mitchell and Miller, 1986; Rasmusren 
and Lind, 1981). By using such decomposition methodology, one can better design the procedure so 
that it will meet the demands. 

For each function (e.g , engine start and push back) the objectives are determined and listed. Once the 
are specified, the tasks required to meet them are listed. Then, the actions required to execute 
each task are listed. Finally, the procedure is designed. The procedure, of course, is composed of all 
lhe [ » < -v'O uslyli,lcd actions necessary to perfonn the task. For example, let us assume thatlhe function 
is engine start and push back. In this case the objectives may be to: 


1 . Start all engines safely and economically 


2. Involve all crew members (both cockpit and ground) in the engine start process 

3. Disconnect and push back safely 
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4. Get ready for the next phase (taxi) 

The tasks and actions are: 

1 Quirted firsT etc**^ ^ grOUnd) regarding engine start sequence: when to start, which engine 

2 ’ safety of ground c^ew °e tc' * PK ' Stm conditions: clearance, configuration, cabin doors locked, 

3. Perform the engine start sequence: ignition selector, open start valve, open spar fuel valve, etc. 

4. Closely monitor start process: oil pressure, N2, Nl, EGT, starter cutout, etc. 

5 . Configure systems after engine start. 

6. Advise ground crew and check for completion of post- ;tart conditions: disconnect external 
power, air, etc. 

7 . Obtain push-back clearance from ATC 

8. Coordinate and monitor push-back and disconnect from the ground crew 
The procedures are: 

1 . Before start checklist 

2 . Engine start process and callouts 

3 . After engine start configuration flow 

4. SOP tasks and callout for coordination with ground crew 

the a ^ equacy and J* compatibility between the SOP and the tasks begin to be 
revealed. If the design and sequence of the SOP associated with engine start and push bade do not 
support all the tasks, then the SOP must be changed. Likewise, if the SOP does nm allow 1 for thT 
fulfillment of all objectives, then either the tasks or objectives must be changed. For an example in 
which the procedure did not support all the objectives, see the example in Section 6.2 3 regarding 
ambiguity in engine start sequence. 


7.2 SCHEDULING OF TASKS AND PROCEDURES 

Two factors affect the flow of procedures in the cockpit. First is the sequencing of tasks and procedures 
which is specified by the designer of the SOPs and checklists. Second?* the actual scheduliJgXsks 
and procedures, which is conducted by the cockpit crew. The goal is to optimize the sequencing in the 
design process and to promote efficient scheduling by the crews. 8 

Tasks require time, attention, cognitive resources, and therefore they contribute to workload The 

nioh 8 f^ r ^?U S . n0l T ereI L t0 n ? inimi f e * orUoad * but also to distribute it throughout the phase(s) of 
flightin order to avoid periods of very high or very low workload. While this is important for any 

routine operation, it appears to be extremely important in today’s automated two-person cockpit. 

7.2.1 " Window of Opportunity " 

For every task on the flight deck, there is a time boundary. This period is sometimes referred to as the 
window of opportunity, indicating the time period in which a task can take place. For example, the 
window of opportunity for the DESCENT checklist can be defined as the time period betweef top of 

40(1 10 ’. (X ) . feet , Th,s time period (i.e.. from time at top of descent to time at 10,000 feet) 
depends on cruise altitude, rate of descent, ATC vectors and restrictions, and therefore may vary. 

a ? vcn # task . can ** effectively accomplished at any time within the window, it appears that 
there is an advantage in conducting the task early. Laudeman and Palmer (in preparation) conducted a 
study to evaluate task-scheduling strategies of airline pilots flying DC-9 and MD-88 aircraft in a full 


^^SST , (Se ^ et ■!- 1991) - repo^d that crews who scheduled their task early 

within the window tended to be rated as high performing crews. Conversely crews ^oShSul^ Zir 

concl u^^'diat* “s^hed u Un^'of l ° *f aS *°a performing crcws * La udeman and Palmer 
SSnom r , 8 > f task T thc wlndow of opportunity is the optimal task scheduling 

and pllmw smdy F gUrc ‘ S 3 graphlCal dep,CQon of windows of opportunity in the Uudeman 
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CSD Low oil light proc. 
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CSD Low Oil Light 
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Procedure ' 
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Figure 1 1. Windows of opportunity during the descent to Columbia, SC. 

The above findings are applicable in light of a recent airline accident (NTSB, 1991): 

In 1990 aMarkAir B-737 crashed about 7.5 miles short of runway 14, Unalaklcet Alaska The cantain fwho 
was the PF) incorrectly deduced the location of the FAF to be 10 DME from the localizer rather than 5 DME 

to 500 feet MSL, 5 mile, moot, 

( eteorological infonnation was: ceiling, 500 feet overcast: visibility 1 .5 miles with fog) The first officer 
(who was new on the aircraft) did not notice, or did not make the captain aware of tS tkrLt^fro^^ 

Wtt^pmcedote The Safely Bom*. however, "believe moKkel, than i , Zm 

monitoring the approach closely because he was preoccupied with his other dunes.” 

hi addition to the regular tasks of the PNF, the first officer had two other tasks to perform* ( 1 ) 
reconfiguring the engine bleeds to aid in avoiding foreign object damage, and (2) starting the APU The 
M^A^ tl,r ^ r0f ^ a,r ? raft ( Bocin g)- recommends that the bleeds be reconfigured below 10000 feet the 

^oT^X^^ S r'f ir !i eS “?"« lhis «»» » MafkTrmal^cX: pikTuS "* 

qv J^y . P . reconfigured as low as possible. ..usually down around couple thousand feet ” tn 
9); the captain bnefed the first officer to reconfigure the bleeds •VhenTrolhn Sn finaL^ (P 


i 

ft 
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During the actual approach the captain instructed the first officer to reconfigure the bleeds as the aircraft 
was in a turn and descending through 1,700. The Safety Board stated that “reconfieurine the bleed 

ar ? u lr nd 1 1 ’ 7 5 0 feet prevented a rapid pressurization change within the cabin, bunvas not reason 
enough to nsk pilot distraction at a critical point in the flight (NTSB, 1991 p. 32). The Safety Board 
concluded with a recommendation to the FAA to “revise the MarkAir flight checklist and training 

tig?*™ th u at b 5^ Swltch ^activation for 8 ravel runway landing is accomplished at sufficient 
altitude so as not to be a distraction during critical phases of flight” (p. 36). 

The following is the MarkAir B-737 procedure for bleed switch configuration (NTSB, 1991): 

If landing on a gravel or contaminated runway, start APU, and when below 5,000 ft. MSL configure 
pressurization system for engine bleeds ofT landing: ’ * 

Right pack switch - ON 

Isolation valve - CLOSED 

Left pack switch -ON 

No. 1 engine bleed switch - OFF 

APU bleed switch - ON 

No. 2 engine bleed switch - OFF 

In summary, a well managed crew schedules the required tasks within a window of opportunity in a wav 
that it will not be done too early or too late. For example, if one wishes to obtain the arrival ATIS there 
is no point in doing this task too early, as the information may change by the time the aircraft will start 
a PP r ^ ch > P^fularlyduring rapidly changing weather. On the other hand, there may be penalties 
tor obtaining the ATIS information too late, since it is required for planning purposes. 

7.2.2 Sequencing in the Window 

Some will argue that completing some tasks early within the window of opportunity is sometimes 

56 a change 7 a new constraint “down the road.” Here are some examples: 
ili Lr r m e f y " ma >' chan 8 e in runway, weather, NOTAMs, etc.; (2) conducting the 

approach briefing -- there may be a runway change; (3) positioning flaps or stabilizer setting for takeoff 
— there may be a change in load manifest, runway assignment. 

Nevertheless, in many discrete cockpit tasks, such as performing checklist items, briefing, mandatory 
halre^vantage^ C3 S * C0nfigurall0n ’ etc ’ ear, y completion within the window of opportunity may 

1 . The task (e.g., briefing), is done and removed from the queue early on. This reduces memory 
load and cognitive scheduling effort from the pilot (“I have to find a good time between ATC 
calls, configuration tasks, and prior to reaching 5,000 feet to do the approach briefing”). 
Decisions, options, and discussion can be formulated early, when the workload is still relatively 

2. If an unanticipated event (e.g., generator failure) occurs, the diagnostic process and the 
reconfiguration process will not interfere with the task (e.g., approach briefing), as it was already 
done early in the window of opportunity. Changes pertaining to the failure can be amended 
during the approach briefing later on. 

3. Conducting some aspect of the task, even if it may change later, guards against completely 
forgetting it in unique cases where the procedure is vulnerable to human error. For example 
positioning the flaps to a takeoff setting before starting to taxi (even though the crew expects a 

io t sS C r!l ang ® ,n ?tPr SC,ting .^ y 8031x1 against total, y forgetting to set flaps for takeoff (NTSB, 
1988; Degam and Wiener, 1990). 

An example of taking advantage of the early completion of tasks within the window of opportunity can 
be seen in one company s policy of minimizing non-configuration tasks below 1 8,000 feetT 
Accordingly, we noticed that some flight crews turn the sterile cockpit light on prior to reaching 18 000 

5i! r A ? ma ^ a,cs s,criIe cock f il bc«ow 10,000 feet). One may argue that this is sub^ptimal, 
sterilizing the cockpit before it is required and thereby discourage necessary cabin-cockpit 

communications (Chute and Wiener, in preparation). On the other hand, flight crews that we observed 
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felt that this is an efficient technique: the task is completed early in the descent and the possibility of 
distractions by flight attendants during the descent are eliminated. In short, the crew found it 
advantageous to be more “sterile” than the law requires. 

7 .2.3 Sequencing of A ctions Within a Procedure 

Sequencing is the internal mechanism that drives many cockpit procedures -- especially critical and time 
dependent procedures. Sometimes the only reason for a procedure is the absolute necessity of a correct 
sequencing of actions (e.g., engine start procedure, engine fire procedure, generator fail procedure, 
etc.). In a previous study (Degani and Wiener, 1990), we discussed sequential deficiencies in the 
normal checklists of several U.S. carriers, in which the procedural flow becomes intermittent (as 
opposed to consistent) in the motor movement of eyes and hands along the panels in the cockpit. While 
conducting the research for this study, we found similar deficiencies in abnormallemergency procedures 
With respect to emergency procedures, these deficiencies are very critical because of the time limitation ’ 
workload, and level of stress involved in dealing with an emergency. In addition, failure checklists are 
mostly performed as “action lists,” i.e., an item is read (or recalled from memory) and immediately 
performed. In this case a sequential mistake can lead a crew member to take an irreversible acdon. 

For example, consider the immediate action procedure for an IRREGULAR START for a medium-ranee 
aircraft (Figure 12): 6 


IMMEDIATE ACTION 


FUEL CONTROL SWITCH 

CUTOFF 

ENGINE START SELECTOR 

. . GND 

Motor for 30 seconds or until EGT is below 180 whichever 
(unless no oil pressure). 

is longer 

NOTE 


If starter cutout has occurred, reselect GND when N 2 is below I 

20% 1 

If problem was other rapid EGT rise: 


ENGINE START SELECTOR . . . 

. . . OFF 


Figure 12. IRREGULAR START procedure. 

If the procedure is carried out in the sequence listed, then the flight crew may overlook the restriction and 
select ground (GND) when N2 is above 20%. A simple solution used by some pilots is to write the 
restriction on the checklist before the word GND. We note that, while one’s intention may be the best 
writing on, and thereby modifying, the checklist card is a violation of FAR 121.315, although it is not’an 
uncommon practice. The dangers of using such “custom built” procedures are quite obvious. 

To conclude, the designer of flight-deck procedures should strive to eliminate any sequential problems 
especially in emergency procedures. That is not an easy job, yet the feedback loop from line pilots ’ 
discussed in Section 3.2.4, can be used to identify these problems. v 
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7.3 DECOUPLING OF TASKS 
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7.3.1 Methods for Decoupling 

The following is a list of several methods ,0 achieve decoupling. This list is certainly no. exhaustive 
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7.4 IMPLEMENTING PROCEDURES 
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While observing several procedure-design sessions, we noted that flight management personnel who 
were responsible for designing procedure could not recall the operational logic and the constraints that 
prompted an existing procedural sequence. This is understandable, specially in light of constant change 
in personal in flight management departments. However, the result is inefficiency - much time is spent 
in p 7 ing to recall or understand the logic and constraints that led to the construct of the procedure. 

Critical constraints may be forgotten, and what is even worse, constraints that may no longer exist, are 
being “carried along.” 

Such documentation can be tied into the “Four-P” model, showing the logical links between the 
procedures, policies, and philosophies. They can be also extremely helpful when questions arise while 
flight crews leam new procedures during transition training. 

Guideline #20: The SOP documentation should not only explain the mechanics of the 
procedure, but also state the logic behind it. A detailed account of the operational logic, system 
constraints, and the link to the “Four-P” model should be pan of the documentation. 

7.4.3 “Selling” Procedures 

Once the decision to change a procedure is approved by flight management and the FAA’s principal 
operations inspector, the change must be communicated to the line pilots. This may seem the most trivial 
part of procedure modification — but it is not. Pilots will usually, in some form or another, resist 
changes in procedures, particularly the ones that may seem as “change for the sake of change.” 
Management must be able to persuade itself ar.d the line pilots that the procedure change is truly 
necessary and beneficial. Flight crews, therefore, have to know the why behind a procedure change and 
not just what and how. The “Four-P” model could be used in this regard, as the logical progression 
from philosophies, policies, to procedures can be shown. 

Right management can be creative in making this “sell.” For example, one airline sent a video tape to all 
pilots in the fleet, explaining and presenting the new upcoming changes. If procedure changes are just 
sent out as a revision to the manual and not properly communicated, then the likelihood of proper 
implementation is low. 


7.5 IMPLEMENTING STANDARDIZATION 

Perrow (1986) contrasts the complex human-machine systems of nuclear power plants with aircraft 
operations: “In the aircraft and the ATC system, we let more of the operating environment in - it 
complicates the situation” (p. 229). This factor, the complexity associated with the interaction with the 
ever changing operational environment, is critical in any attempt at standardization. If one could better 
control the environment, then a greater level standardization could be achieved (Landau and Stout, 

1979). Unfortunately, that is almost impossible. 

When a company is relatively small, standardization is sometimes achieved by default 18 . Pilots 
traditionally had a clear career path, i.e., they transition through the different seats in a consistent 
sequential manner. Nevertheless, in today’s mega-carriers, this clear career path does not exist because 
of the sheer size of the organization, the number of bases, and the variety of aircraft in a company's fleet 
This is why standardization has become such an important issue. There are several components to the 
efficient standardization of procedures, which we shali now discuss. 


18 Note that we have used the term "standardization" in two ways in this report In the sense of the present discussion, it 
refers to commonalty of cockpit hardware and procedures within and across fleets. In previous discussions (see Section 
3.2.3), the term referred to management's function in quality control of pilot performance in adherence to procedures and 
regulations. In the first sense, it is hardware and supporting documentation and devices that are standardized, in the second it 
is the crew members' behavior. 
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7.5.1 Cross-fleet Standardization 

Cross-fleet standardization is an economic (and sometimes emotional) topic that involves complex trade- 
offs, and often has no easy solution. If done properly, cross-fleet standardization provides for smooth 
transition from one aircraft to another, and a solid framework for training, checking, and line flying. 

During our visits to the airlines, we attended such standardization meetings. In one meeting, the agenda 
items was the cross-fleet consistency of the DESCENT, APPROACH, and LANDING checklist with 
respect to the altimeters check. 

The problem was that in Europe, the transition altitude varies from nation to nation and can be as low as FL 40. 
Likewise, in some parts of the Caribbean (where U.S.-operated domestic narrow body aircraft also fly), the 
transition altitude is lower then in the U.S. The procedural dilemma was how to implement a procedure that 
checks that altimeters are set to QNH during descent into the terminal area. 

The first alternative was to have all aircraft c heck altimeters at 18,000 feet (note, however, that this is an 
unnecessary check when the transition altitude is below 18,000 feet). The second was to have all aircraft check 
altimeters with the APPROACH checklist (which is conducted below 18,000 feet) to “cover” those aircraft that 
fly to the Orient were transition altitude may be somewhere between FL 140 and FL 80. This would add a 
“nuisance” checklist items to the domestic narrow body aircraft). The third was to have all aircraft check 
altimeters with the LANDING check to cover all those aircraft that arc ’anding in Europe. The effect of this 
standardization would be to add two "nuisance” checklist items to the domestic narrow body fleets. 

The final solution was to list altimeters checks in the DESCENT and APPROACH checklist only. The 
altimeters check was to be written as the last item on the APPROACH checklist, and a to go item was to be 
allowed. When the APPROACH checklist is performed above the transition altitude, the PNF will say 
“altimeters to go” and wait until the transition altitude is reached in order to complete the APPROACH 
checklist. 

The benefits of cross fleet standardization are quite obvious. And there are vast areas in cockpit 
operations where this can be done properly (mainly in the non-aircraft specific procedures, e.g., 
precision/non-precision profile callouts, and many more). Nevertheless, it is not always possible. If 
done improperly, it may lead to sub-optimal procedures by superimposing procedures that are suitable 
for one type of cockpit operation on another. This kind of cross-fleet standardization may turn out to be 
a very expensive will-of-the-wisp. 

Part of the altitude verification procedure described in Section 5.7.2 is also illustrative of a trade-off in designing 
cross-fleet procedures. This procedure specifies the duties, with respect to manipulation of controls between the 
PF and PNF, as a function of the level of automation used: hand flying (PNF manipulates the MCP controls) or 
autopilot operation (PF does so). This procedure was generic to the extent that it could be used across all fleets, 
with exception, however, of the DC-9 fleet. 

In the DC-9 cockpit, the location of the altitude alerter is adjacent to the F/O's left knee. It is difficult for the 
captain to access, set, or read its numeric display. Therefore the procedure for the DC-9 fleet is different from 
other fleets: the F/O always sets the altitude alerter, regardless of whether he or ye is the PF or PNF. An 
entire cross-fleet standardization could be not be achieved -- the price was just too hig.' 

Inappropriate standardization may therefore interfere with the intelligent exercise of piloting tasks 
(Johnston, 1991). In such cases, the flight crews are the ones who have to bear the consequences of this 
incompatibility. We therefore argue that the airline must develop a philosophy for cross-fleet 
standardization. Such a philosophy can help draw the line between reasonable and unreasonable cross- 
fleet standardization efforts. This will allow the designer a frame of reference with regards to such 
procedures. Once communicated to all, the standardization philosophy may allow other persons (such as 
instructors, IOE and line check airman, FAA inspectors, and line pilots) to better understand, critique, 
and check such procedures. 

An additional measure for improving standardization efforts is creating a formal cross-fleet forum (such 
as one company’s fleet captains’ uoard). This forum, which includes the lead captain from every fleet in 
the airline, meets regularly and is the only entity that approves such procedural changes. The fact that 
any procedure change must be approved by all fleet captains, enhances coordination and minimizes the 
likelihood of improper cross-fleet standardization procedures. Likewise, involving the entities that teach, 
use, and check procedures (ground training, flight training, line pilots, check-airman, etc.) in procedural 
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Guideline #21: While benefits of cross fleet standardization are quite obvious, there are certain 
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procedures by superimposing procedures that are suitable for one type of cockpit operation on 

Guideline #22: We recommend a three-way approach for a cross-fleet standardization. (1) 
Development of a cross-fleet philosophy, (2) creating a cross-fleet standardization forum and 
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7.5.2 Within-fleet Standardization 

mIS^ e Ji!S 0 p Standardi f ' ti ? n ’ sometimes neglected, is between different procedures used on the same 
model aucraft. For example, in one narrow body aircraft fleet, the CAT I and CAT II callouts were verv 
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This, we believe, is a breakdown of the foundation of SOP; procedures that are designed tobe the 
common baseline no longer serve that function. We again remind the reader of our view that all co^knit 
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7.5.3 The Model for Standardization 

The concepts of opration of a three-pilot cockpit is very different from that of a two-pilot cockpit 
primarily in distribution of workload between crew members. In addition, glass cockpits also reauire a 
very different philosophy of operations than their predecessors (Wiener, 1988, 1989). ^ 

teB-SZftlSZZ m0 u ving / way from havin 8 a three-pilot cockpit aircraft such as 

the B-727 or B-747 as the model, or flagship, for standardization of procedures. This transition 

however, does not solve the problem of standardization-compatibility between glass cockpit aircraft and 
three pilot cockpit - it simply changes the aircraft employed to set the standards P 

approaches to this standardization issue. One approach is to standardize the fleets 
according to two distinct standards (i.e., glass cockpit fleets and traditional cockpit fleets). There are 

same app ™ ach as , the aulofli 8 ht system of most glass cockpit aircraft are basically the 

n^eH^i y ° n,ght . related P^^ures such as PF/PNF duties in various inodes, initial climb * 

If ’ PreC n‘°u and non 'P r e a sion procedures, and many more, can be standaidized efficiently 
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fleets, a review of their procedure does not support that. Another approach is to attempt^ £2 
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7.5.4 Standardization in Checking 

checking are part of the process of transporting the procedures from flight 
standards to the line, it is another source that generates deviations from mandated procedures In most 
airlines there are four entities that are part of this process: procedures, in most 

1 . Training department (for both pilot training and proficiency checks) 


If . Somewhere between cross-fleet and within-flcct standardization is the coomlicated i«n<* r»f pnmmn«w. . 
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2. Check airman program 

3. FAA inspection 

4. Line operations 


Because each one of these entities has different perspectives and objectives with regards to procedural 
execution, there may be differences in how pilots are required to perform. Flight management should 
attempt to minimize, to the degree possible, the differences in pilot performance between these “worlds.” 
The all-too-classical statement, “I don't care what they taught you in ground school, this is how we do it 
out here on the line” portrays a genuine standardization problem. Indeed, several flight crews that we 
interviewed complained that this was the rule. In their view, the training department had a different 
concept of flying then flight standards, line operation had different concepts of operation than training 
and lOE, and even worse, the FAA inspectors expected something still different. It is important to note 
here that those differences in concept of flying mainly centered on usage of the autoflight system of glass 
cockpit aircraft. The most common differences in philosophy were ( 1 ) cockpit set-up for different 
phases of flight and (2) engagement of autoflight modes. 


We believe that the “Four-F’ model detailed in this report, in conjunction with some organizational 
counter-measures, may be helpful in minimizing such differences. When philosophies and policies of 
operation are stated and communicated, us sets a single unequivocal baseline to all entities involved. 
Performance can therefore be judged or justified against this baseline. 


Guideline #23: The flow of any procedure through design, training, checking, 
implementation, and finally feedback, must be supported by the organization^ structure. 
When a new procedure, or a modified procedure is established, it should be closely monitored 
(by standardization and check airmen, and LOFT instructors) for compliance. 


To summarize, any procedure, even the best one, can never be “bullet proof.” Since the environment 
around the plane is dynamic, the procedures and policies can only provide a baseline. This, we believe, 
is the true meaning of standardized procedures. The role of flight management is to provide the best 
possible baseline for the flight crews. “In any operational situation, seek to identify the non-standard or 
idiosyncratic item of operational significance with is relevant to the task. In other words, avoid reducing 
flying to an almost mindless ritual in which the normal or standard is unthinkingly accepted" (Johnston, 
1991). Procedures should be designed to represent a standardized baseline, but not substitute for an 
intelligent pilot. 


I 



8. SUMMARY AND CONCLUSIONS 


Flight deck procedures are the backbone of cockpit operations. They are the structure by which pilots 
operate aircraft and interact with other agents in the system. Procedures are probably one of the most 
important factors in maintaining flight safety -- during both normal and abnormal conditions. 

It was traditionally believed that procedures are only hardware/software dependent — that they are 
inherent in the device. We have tried to show throughout this report to that this is not the case. We 
argue that they «ue also dependent on the operational environment, the type of people who operate them 
and the culture of the company they work for, and the nature of the company's operations. Procedures 
are not inherent in, or predicable from any single entity. 

We have emphasized four factors: compatibility, consistency, quality management, and feedback. 
Compatibility assures that the procedure is logical and appropriate in the scope of the larger system in 
which it is operated. Consistency provides the structure of procedures, assuring the line pilot that there 
is a reason for any given procedure, and that this reason is pervasive within a particular aircraft, between 
fleets, and throughout the company. Quality management is the sentinel that provides standardization 
and guards against non-compliance. Feedback provides a final check, the assurance that the cold light of 
the real world is the final test of the goodness of any individual procedure or policy. 

We have attempted to demonstrate, that even in this highly procedurized system, there is room for 
individualism and that individualism can, and should be designed into these human-machine systems. 

We have also tried to show that there is no set of procedures that can substitute for the intelligent human 
operator. And therefore the constraints of the human operator and the unique environment in which he 
or she is to operate must be thoroughly considered in the process o f designing procedures. 

We believe that there is no “royal road” to procedure development. There is no such thing as an optimal 
set of procedures. No manager will ever be able to “open up the box,” install the device, and install 
“good” procedures along with it. Nor do we anticipate that any computer technology can make this 
easier. Pilots are trained to fly by procedures. Aircraft are built to operate by procedures. Government 
regulations are based on procedures. It is a long, tedious, costly, exhausting process. We do not know 
of any shortcuts. 
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APPENDIX 1 - GUIDELINES FOR PROCEDURE DEVELOPMENT 

Tlw following is a list of guidelines that were introduced in this report: Section numbers, where these 

guidelines are discussed, are in parenthesis. 

1. Afeedback loop from line pilots to flight management and procedure designers should be established. 
This feedback loop should be a formal process, as opposed to an informal process. It must be 
maintained as a non-punitive, reactive system, with mandatory feedback from management to the 
initiating line pilot about the progress of his report and/or suggestion. (Section 3.2.4) 

2. When designing procedures for automated cockpits, the designer should recognize that many tasks 
that involve the use of automation are too complex and interactive to allow a stringent set of SOPs to 
be mandated. (Section 5.6) 

3. It is essential that management develop a philosophy of its operations. This is particularly impoitant 
for operating automated cockpits. (Section 5.6.1) 

4. When introducing new technology into the cockpit, the procedure designer should reevaluate all of 
the existing procedures and policies in light of the new technology and support the new technology 
via new procedures. (Section 5.6.2) 

5. Management, through the feedback loop and the line check airman program, should be watchful of 
techniques that are used on the line. Techniques that conform to procedures and policies should not 
be interfered with. Techniques that have a potential for policy and procedure deviation should be 
addressed through the normal quality assurance processes. Techniques that yield better and safer 
ways of doing a task may be considered for SOP. (Section 5.7.4) 

6. Care must be taken that not only the principal participants of a system (e.g., flight crews in this case), 
but also others that are affected (e.g., controllers, ground crews, cabin attendants) be involved and 
informed in the design and modifications of a system procedure. (Section 6.1.1) 

7. Procedures must be tailored to the particularities of the type of operation. Ignoring these 
particularities can foster low compliance with procedures on the line. (Section 6.1.2) 

8. The procedures designer must be mindful of the limitations and capabilities of the device he or she is 
designing a procedure for. Devices that are well designed for the human user require minimal 
procedurization. Less robust devices will require more thought on the part of the designer, and will 
probably require more complex and lengthy procedures. (Section 6.1.3) 

9. Management must guarantee that any procedure is compatible with the engineering of the aircraft or 
any sub-system. Care must be taken when there are subtle differences between aircraft (especially if 
these differences are invisible or difficult to detect). Incompatibility can be resolved either by re- 
engineering or procedure. (Section 6. 1 .4) 

10. Airframe manufacturers and component suppliers (such as avionics firms) must be attuned to general 
airline procedures. Knowledge of such procedures may influence ergonomic considerations. 

(Section 6.1.5) 

1 1. The entire documentation supplied to the cockpit (and elsewhere) should be regarded as a system, 
and designed accordingly as a system, not a collection of independent documents. A clear and 
logical (from the user’s view) structure for this system and a criterion for the location of different 
procedures is important. An effective index in each manual would go a long way toward aiding 
pilots in finding materials they seek, especially when it is an unfamiliar, obscure, or seldom accessed 
procedure. (Section 6. 1 .6) 

12. Paperwork should be designed carefully to be compatible with the device for which it is intended. 
Particular care should be exercised in preparing materials for computer-based systems. It may be 

necessary to provide differently formatted documents for different cockpit configurations. (Section 
6.1.7) 

13. Procedure design includes intra-cockpit communication. The expected communication should be 
specified, trained, and subject to standardization like any other procedure. (Section 6.2.1) 

59 





14. In managing automated cockpits, briefing becomes an critical crew coordination tool - not so much 
to reduce variance, but rather to reduce die level of ambiguity of other agents (e.g., PNF or FA)) by 
increasing expectations. The more one allows for technique, the more one has to stress briefing. 
(Section 6.2.2) 

15. If the same procedure can yield significantly different outcomes, then the procedure must be 
modified in older to eliminate its embedded ambiguity. In brief, a procedure should lead to a totally 
predictable outcome. (Section 6.2.3) 

16. Particular attention should be paid in order to safeguard information transfer during critical and high 
workload phases of flight. Callouts should be economical, unambiguous, and should convey only 
the information needed by the other crew members). They should not distract the crew member 
from his primary task(s). Finally, we urge frequent review of callout procedures: as other 
procedures change, callouts should be reexamined. (Section 6.3) 

17. Procedure designers should always bear in mind the contribution which any procedure makes to total 
workload of the crew at any given time. They should be especially sensitive to procedures that may 
require crew attention in times of high workload, and should strive to “manage” workload by moving 
tasks that are not time-critical to periods of low workload. (Section 7.2.3) 

18. The designer of flight-deck documentation should search for situations where procedures are tightly 
coupled, and exploit the opportunity to decouple them. (Section 7.3) 

19. frequent procedure and checklist changes lead flight crews to conclude that the system is unstable. 
This may diminish the importance they attribute to new and modified procedure. Therefore, 
management should minimize frequent procedures or checklist changes. It is probably better to 
bunch them together and make larger, less frequent “bundles” of changes if the items are not time- 
critical. (Section 7.4) 

20. The SOP documentation should not only explain the mechanics of the procedure, but also state the 
logic behind it. A detailed account of the operational logic, system constraints, and the link to the 
“Four-F” model should be part of the documentation. (Section 7.4.2) 

21. While benefits of cross fleet standardization are quite obvious, there are certain situations where this 
type of standardization is just inappropriate. It may lead to sub-optimal procedures by 
superimposing procedures that are suitable for one type of cockpit operation on another. (Section 
7.5.1) 

22. We recommend a three-way approach for a cross-fleet standardization. (1) Development of a cross- 
fleet philosophy, (2) creating a cross-fleet standardization forum, and (3) obtaining input for 
procedural design from personnel that design, certify, teach, use, and check procedures. (Section 
7.5.1) 

23. The flow of any procedure through design, training, checking, implementation, and finally feedback, 
must be supported by the organizational structure. When a new procedure, or a modified procedure 
is established, it should be closely monitored (by standardization and check airmen, and LOFT 
instructors) for compliance. (Section 7.5.4) 
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(Reprinted from Wiener, Chidester, Kanki, Palmer, Curry, and Gregorich, 1991) 


APPENDIX 3 - QUESTIONS ASKED OF FLIGHT MANAGEMENT 


The following is a list of questions that were asked during our meetings with flight management 
personnel at each of the participating airlines: 

1 . Is there an overall philosophy that makes this airline different from other airlines? 

2. Suppose you had the same job at another airline. In what way would the concept of operations 
differ? 

3 . Where does philosophy influence policies 9 

4. How are the policies of flight department affected by highest level of management? 

5 . How do top-level management policies become formed and move down the ranks? 

6. Why do you take a Boeing procedure and change it? 

7 . We recognize that the bottom line affects everything in the industry since deregulation. How is 
this incorporated into the flight department policies (fuel, on-time departures, maintenance)? 

8. What influence do the pilot representatives committee have on policies? 

a. What is your relationship with pilot representatives committees? 

b . Do you feel that your relation to pilot representatives committees is adversarial or 
cooperative? 

9. What are your policies with regards to automation and its use? 

10. What is currently the process for feedback from the “line” about procedures, does this reach 
your desk? 

11. What is the lowest level of detail that you get involved in regarding flight deck procedures? 

12. What is the biggest challenge in your job? 

13. What can we do to help your company? 
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APPENDIX 4 • QUESTIONS ASKED OF LINE PILOTS 


The following is a list of questions that were asked during our formal meetings and discussion with 
groups of line pilots: 

1 . Is there an overall philosophy that makes this airline different from other airlines? 

2. Where does philosophy influence policies? 

3. How do top-level management policies move down the ranks? 

4. Can line pilots afreet the design and modification of procedures? If so, how is this done? What is 
your relationship with pilot representatives committees? 

5. What are your company's policies with regards to automation and its use? What is your own 

view of this? 3 

6. Are there any cumbersome procedures in your SOP? Which ones? Have you developed an 
effective “personalized procedure” (technique) to combat them? What makes a procedure 
smooth? 

7 . What is the interaction between procedures and automation? Do you see fewer or more 

procedures in an automated aircraft? In what way have procedures changed between the Boeing 
B-727 and the new glass cockpits aircraft? (has the philosophy, spirit, or mind-set changed 
who s responsible for what) 6 

8. What affects the successful design as well as execution of procedures? 

9. Are there any differences between procedures you are taught in the training center and those vou 

perform on the line? 3 

10. What is the biggest challenge in your job? 
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APPENDIX 5 • QUESTIONS ASKED DURING JUMPSEAT OBSERVATIONS 


The following is a list of questions that were used during our informal discussion with line pilots while 
conducting jumpseat observations: 

1 . Are there any cumbersome procedures in your SOP? Which ones? Have you developed an 
effective personalized procedure” to combat them? What is a smooth procedure? 

2. What is the interaction between procedures and automation? Do you see fewer procedures or 
more in an automated aircraft? In what way have procedures changed between the Boeing B-727 
and the new glass cockpit aircraft? (has the philosophy spirit, or mind-set changed, or who is 
responsible for what?) 

3. What affects the successful design as well as execution of procedures? 

4. Are there any differences between procedures you are taught in the training center and those you 
perform on the line? 


appendix 6 - Categories of factors that trigger procedure change 


The following is a list of seventeen categories of events that prompted procedure changes: 

1. New equipment. Example: TCAS. 

The introduction of TCAS required the development of procedures for the configuration of the 
equipment, exercise of option' (e.g., TA-only vs. TA/RA mode for takeoff), and then in-flight 
procediues in the event of TA*> and RAs. Since TCAS was an entirely new development, procedure 
writers had to “start from scratch,” as there was no history nor precedent for airborne collision warning 
devices. 

2. New regulation. Example: No-smoking rule in the cabin. 

Although the no-smoking rule (first for flights under two hours, later extended to flights under six 
hours) was aimed at behavior in the passenger cabin, it impacted the cockpit in that the no-smoking light 
had previously been used for various cockpit signals to the cabin personnel. With the enactment of the 
smoking regulations, the no-smoking sign was left “on,” and other signals had to be devised. 

3. Unfavorable experience. Example: High rate of altitude deviation violations. 

* n I" 0, USAir was experiencing a high rate of altitude deviations (four FAA-reported cases per month) 
A thorough study resulted in a procedural intervention whereby the pilot not flying entered the command 
altitude in the alerter, repeated the altitude orally, and keep his or her finger on the knob until the pilot 
flying repeated the altitude and also touched the alerter. If there was any difference in their callout, the 
PNF had to resolve it by calling ATC. In the months following the intervention, FAA-reported cases 
dropped to less than one per month (Glines, 1992). 

4. New routes. Example: Extended two-engine operations (STOPS). 

The use of two-engine transports such as the B-767 and A-310 on long over-water flights demanded the 
development of a series of special procedures, even above those required for international flight of three- 
and four-engine aircraft. For example, after takeoff, at a certain time into the flight, the aircraft would 
nave to be re-released when it reached the “ETOPS entry point.” Special procedures were also needed 
for selection of alternates. (Hughes, 1992; Steenblik, 1991). 

5. New management. Example: Mergers and acquisitions. 

In the event of a merger or acquisition (see Section 5.3), the acquiring company typically standardizes 
the acquired fleets against their own, by imposing its procedures on the combined fleet. This usually 
results in considerable retraining for the acquired pilots. Where a new aircraft model is acquired in a 
merger or acquisition, considerable procedure writing is necessary to bring its procedures into 
conformity with those of the acquiring carrier. (Degani and Wiener, 1990, pp. 27-28). 

6. New ATC procedure. Example: Procedure for LDA approach at San Francisco International (SFO). 

The current LDA approach to Runway 28R at SFO requires an entire page of explanation (1 1-3A) in the 
Jeppesen manual to detail all of the procedures. Pilots have asked, “What if I’m set up for something 
else and I get shifted to the LDA? Am I supposed to take the time to read this page?” 

7. Labor relations. Example: Power back from gates. 

In the 1980‘s airlines began the practice of powering back from the gate. This called for the development 
of a set of cockpit and cockpit-ground communication procedures. The motivation for power-back was 
largely to sidestep labor contracts which required that mechanics be used to push the aircraft back 
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8. Change in operational environment. Example: Mountainous terrain. 

With mergers and acquisitions came new routes and new environments. For example, when Delta 
acquired Western, it acquired routes into a large number of airports, some more adequate than others, in 
the western U.S. This required a reexamination of Delta's procedures for approaches and departures to 
and from airports with high surrounding terrain. 

9. Cross-fleet standardization. Example: Shift to lower power radar sets. 

In a previous paper (Degani and Wiener, 1990) we discussed an airline which had a large fleet of DC-9s, 
and a small number of MD-80s (at that time DC-9-80). The -80 carried a radar set requiring much less 
electrical energy than the DC-9s. At that time pilots were allowed to fly both aircraft. Because of the 
lower energy set, the -80 radar could be turned on in ground operations without hazard to ground 
personnel; the DC-9 sets could not be. Fearing that pilots flying both models might inadveitendy turn on 
a DC-9 set on tht ground, the standards group decided to adopt a conservative procedure, and the MD- 
80 radar was operated in the same manner as the DC-9. The somewhat sub-optimal procedure for the 
use of the -80 radar was a minor consequence. 

10. Marketing influences. Example: Better service for first-class passengers. 

The following example illustrates the extent to which marketing considerations can influence cockpit 
procedures. In-flight service has advised flight management that better service can be provided to first 
class passengers if 2L (second door on left side of the aircraft) rather than 1L, is used for boarding and 
disembarking passengers. This way the tourist-class passengers do not have to walk through the first- 
class section. The procedure instructs the B-757 flight crews to “start the APU after landing in order to 
shutdown the left engine as soon as possible after gate arrival^.” The procedure also addresses safety 
implications of having the jetway so close to the left engine - “pay particular attention to the position of 
jetway. If you think you are being told to taxi too far past the jetway and are concerned about the left 
engine [hitting the jetway], don’t hesitate to stop ard asked to be towed in or talked in." 

11. New company policy. Example: Required use of flight directors. 

Airlines have had to strike a balance between requiring the use of certain automation features, and leaving 
this choice to the discretion of the crew (see Appendix 1). This is one of the more difficult policy issues 
in procedure writing today. On one hand management may feel that it has the prerogative to set policy 
for the use of automation. On the other hand, flight crews generally feels that such decisions should 
remain in the cockpit (see Wiener and Curry, 1980, Guideline No. 5, p. 1009). 

One example would be a policy for the use of the flight director on takeoff. We have found a variety of 
procedures among the airlines on this issue. Many pilots prefer not to use it (presumably to de-clutter the 
ADI display); some companies now require its use, principally for its availability for pitch guidance in 
windshear encounters. One company specifies that the flight director not be used on takeoff until 
reaching 3000 feet unless the aircraft is equipped with a windshear guidance program. 

12. New company philosophy Example: “A captain’s airline" 

Delta Airlines had once prided itself on being “a captain s airline.” There is no precise definition of what 
this means, but in general it reflects a view consistent with military discipline, namely that the captain is 
supreme in the cockpit, and the junior officers are there to carry out his commands. Following a series 
of rerious incidents (fortunately no accidents) during the summer of 1987, Delta reconsidered this 
philosophy, and instituted a CFM course that stressed crew coordination and cross-checking (Byrnes 
and Black, 1993). This in turn brought new procedures, including an increased emphasis on pre-takeoff 
briefings. 
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20 The reason that the APU should be started before shuuing down the left engine also involves passenger comfort. If the 
left engine is shut down (and with it the left hydrauiic pump) a power transfer unit (PTU), supplying hydraulic power to the 
left hydraulic system, is automatically activated. However, the PTU is rather noisy and annoys passengers sitting in the 
back of the aircraft. To prevent the PTU from being automatically activated, the APU is started. 


L 


66 


13. Noise abatement. Example: Santa Ana, California. 

Locally imposed noise abatement procedures find tfteir way into the cockpit. These may involve low- 
altitude turns away from populated areas, and low altitude power reductions on takeoff. One of the local 
requirements most onerous to the pilots is found at John Wayne Airport at Santa Ana, California, which 
requires a power reduction at 1000 feet. There is a certain amount of “game playing" at some airports - 
pilots have in their Jeppesen manuals ground plots showing the locadon of the sound measuring 
microphones, and attempt to avoid these. 

14. Change in recommetuled maneuver. Example: Winds hear detection and avoidance. 

As new data on windshear occurrences become available, procedures are fine-tuned for avoidance and 
escape maneuvers. There has been a dramatic change in procedure in the last five years. At one time it 
was recommended that the crew apply maximum power and pitch up until actuating the stick shaker, 
trading airspeed for altitude in order to obtain maximum distance above terrain. The current 
recommended procedures specify that the crew not flirt with a stall, but pitch up to a level computed by 
on-boaid automation and displayed by the flight director, at an angle of attack that would stop short of 
shaker actuation. 

15. Maintenance data. Example: Anti-skid 

The engineering/mainte nance department of one carrier discovered that the tire replacement rate of one 
aircraft fleet was above the rates recorded at other carriers. It was found that skidding while taxiing led 
to the high rate of tire change. Tne procedure was changed so that anti-skid was always activated. 
Subsequently, the rate o f tire replacement dropped. 

16. New natural hazards. Example: Volcanic plumes. 

The eruption of volcanoes in the northwestern U.S., and in the Philippines in recent years has provided a 
new awareness of the hazard to navigation. New procedures for avoidance and management of the 
hazard for both the cockpit and ATC have recently been implemented. 

17. New man-made hazards (intentional and otherwise). Example: Terrorism. 

Persons external to the crew, intentionally or otherwise, often provide hazards to flight safety and 
security. The appearance of terrorism directed toward commercial aircraft is an unfortunate example of 
willing introduction of hazards. Cockpit procedures and training are continually being revised as new 
forms of terrorism appear. An example of unintended, human-indued hazards would be the unsafe 
packaging and handling of hazardous cargo. This too impacts cockpit procedures. 
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